{
    "apiVersion": "v1",
    "items": [
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "fj-multi-component-child-plub",
                    "build.appstudio.redhat.com/nudging-commit": "5b2c5fb0386fc73b4951e671ac3a9c331d2ce027",
                    "build.appstudio.redhat.com/nudging-component": "fj-multi-component-parent-plub",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-elet/fj-multi-component-parent-plub:5b2c5fb0386fc73b4951e671ac3a9c331d2ce027",
                    "build.appstudio.redhat.com/nudging-pipeline": "fj-multi-component-parent-plub-on-push-l69fm",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-elet/results/b34f49f6-2a17-4ccf-9020-72dae4d6889f/records/f45841f0-bf26-461e-a0d8-94df3c3e0f58",
                    "results.tekton.dev/result": "build-e2e-elet/results/b34f49f6-2a17-4ccf-9020-72dae4d6889f",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-5f5af19af499b004ca935affc329a6a2-cf16e48bb79571e3-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:20:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1778642401-fc2a5",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1778642401-fc2a5",
                    "tekton.dev/pipelineRunUID": "b34f49f6-2a17-4ccf-9020-72dae4d6889f",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1778642401-fc2a5-renovate",
                "namespace": "build-e2e-elet",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1778642401-fc2a5",
                        "uid": "b34f49f6-2a17-4ccf-9020-72dae4d6889f"
                    }
                ],
                "resourceVersion": "125262",
                "uid": "f45841f0-bf26-461e-a0d8-94df3c3e0f58"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-plub",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_3bce47ad16 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-plub-908b1.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_elet_fj_multi_component_parent_plub_7352796eaa','password':'${TOKEN_9900b23a5b}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642401-fc2a5"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642401-fc2a5"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642401-fc2a5"
                            },
                            "name": "renovate-pipeline-1778642401-fc2a5"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642401-fc2a5"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:20:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:20:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1778642401-fc2a5-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-5f5af19af499b004ca935affc329a6a2-cf16e48bb79571e3-01"
                },
                "startTime": "2026-05-13T03:20:01Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c9604a106ff3670ec85cddac29eb613a888c3b7e789a566941d09607b304a127",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:20:16Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:20:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_3bce47ad16 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-plub-908b1.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_elet_fj_multi_component_parent_plub_7352796eaa','password':'${TOKEN_9900b23a5b}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642401-fc2a5"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642401-fc2a5"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642401-fc2a5"
                            },
                            "name": "renovate-pipeline-1778642401-fc2a5"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642401-fc2a5"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/158bd644-b8dc-47fe-9d81-b34fc8c1092a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-8d7b895f9741a563-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:22Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-1df98efa73b8a70764b27c09b55d4801-deprecated-base-image-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "89233",
                "uid": "158bd644-b8dc-47fe-9d81-b34fc8c1092a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-1df98efa73b8a70764b27c0912d4ff7980e5c5390771856ba0994a03-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\", \"digests\": [\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:08:34+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-8d7b895f9741a563-01"
                },
                "startTime": "2026-05-13T03:08:22Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fbf66309f31ab2d0284c0ab133de13c6186eb6cfec6fd54749555fab1ef456f7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:35Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\\\", \\\"digests\\\": [\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:34+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:27Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/720fe680-d7f5-44d8-a7ec-8bec4bd50d43",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-6cbb2bfe1383487c-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gh-431dcc60ae2414c2956ed2c2cd0000c2-deprecated-base-image-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "108790",
                "uid": "720fe680-d7f5-44d8-a7ec-8bec4bd50d43"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-431dcc60ae2414c2956ed2c2acdd21ac4703994c3d0d73f0d4ad8e03-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\", \"digests\": [\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:13:58+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-6cbb2bfe1383487c-01"
                },
                "startTime": "2026-05-13T03:13:46Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://791a482a316b937be01aa6a44be0040052a16d4a9571117ecd989a861a098adc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\\\", \\\"digests\\\": [\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:58+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/7b286c2f-dbd1-4b9e-9064-8be1a8ad3420",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-d7d058e748d1e3d8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-7edb00f7eeeaee1e5eaf2c8960209707-deprecated-base-image-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "88086",
                "uid": "7b286c2f-dbd1-4b9e-9064-8be1a8ad3420"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-7edb00f7eeeaee1e5eaf2c891c1adc297233594e7fa47a2a5b0b9ee7-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\", \"digests\": [\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:15+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-d7d058e748d1e3d8-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f2f7eb3cdec03b2c717b337eb11dc0f230aff82374e23797e5befec7cc8cbbcb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:15Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\\\", \\\"digests\\\": [\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:15+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:56Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/9f44a998-af35-40a3-a2ad-360a2a481a63",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-e70002066de039d7-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gh-92b8bf87781c923dd5684cbf9788c768-deprecated-base-image-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "108915",
                "uid": "9f44a998-af35-40a3-a2ad-360a2a481a63"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-92b8bf87781c923dd5684cbf7e70f480d0bed86b2a7163d7fb12c277-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\", \"digests\": [\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:13:59+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-e70002066de039d7-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://509f224cb4c851fd62592516b1d7b92062e23017e7ee967c6e9a24656cb3d8e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:59Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\\\", \\\"digests\\\": [\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:59+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:51Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/3e992b5c-a0bb-4a03-8b31-0007d16f7188",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-81c57599a3502f74-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check"
                },
                "name": "gh-951cf4a01e3937cef45c66b46f27780d-deprecated-base-image-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "109112",
                "uid": "3e992b5c-a0bb-4a03-8b31-0007d16f7188"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-951cf4a01e3937cef45c66b4a1390c26eb120119e6c1bf8e4b421f2d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\", \"digests\": [\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:14:03+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-81c57599a3502f74-01"
                },
                "startTime": "2026-05-13T03:13:50Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0d69974ca9a6d02d95322cd081fc433b655b9f44641045954c54c0327f894019",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\\\", \\\"digests\\\": [\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:03+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/a77a97d2-b128-4882-8ef5-efbce49e7fd5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-0f558d73696233e0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:01:47Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-1df98efa73b8a70764b27c09b55d4801-prefetch-dependencies",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "73971",
                "uid": "a77a97d2-b128-4882-8ef5-efbce49e7fd5"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tnfase"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:02:40Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:02:40Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-1df98efa73b8a707644ece981fd57e31f36f0611e20eef93a5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-0f558d73696233e0-01"
                },
                "startTime": "2026-05-13T03:01:48Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://30186ce860ce8fec0870485807381369f4d798f3acc6e54b99138b4a3ec007de",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:56Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a37a9337d84940de54db4693b100b763a5c487e8222815c37ad086494f512b02",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:56Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dae860385fd963e1a22b947ccddb2f87a3edd65d74cb4d64f8d1c70673865d7a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:39Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://89f8bc4309e74ba300d4a1a2fe39b29626f63d5163824a43bd65a4947401ceb9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:40Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/09d13c37-9805-4ee3-a169-348645c35f36",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-393484df031377bf-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:32Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-431dcc60ae2414c2956ed2c2cd0000c2-prefetch-dependencies",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "100808",
                "uid": "09d13c37-9805-4ee3-a169-348645c35f36"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-cweoci"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-431dcc60ae2414c295ade89083f4c0f9820e9f3e883c920771-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-393484df031377bf-01"
                },
                "startTime": "2026-05-13T03:10:32Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a733d7fb7fb0e100afc2e09382714cfea6105d75d23fd1b819581a0c5a2eb77e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://83427cc46523fcfc713a9818566f874dfd87c6dffc55014baed084ed159f5297",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3913ec7b647c60a60fc60664f3ba06f51c4693e857c3c96e194bb4a63cd6c272",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2d10fad8b5bccf23c40af7cfa8b02ab3d5b9b8d46d181096b0750b9ace48b7e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:23Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/aebecdee-a97c-46a5-b3e0-e99ac44f7091",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-9ee1dcd95d4a7d23-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:01:20Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-7edb00f7eeeaee1e5eaf2c8960209707-prefetch-dependencies",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "73785",
                "uid": "aebecdee-a97c-46a5-b3e0-e99ac44f7091"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-mhgahl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:02:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:02:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-7edb00f7eeeaee1e5e03593c4a07be9964111df1a826b5eee5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-9ee1dcd95d4a7d23-01"
                },
                "startTime": "2026-05-13T03:01:20Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://aa5c61cda7e4f87ab46bf33c48670757752f02ce506e7c18ab4405ac5049e6fc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:56Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ad3ee1013531b3171c2204caed546247150cba6900ffdfc227e40e80a67af2fc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:57Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4a054efd13a5ded1bad4e1e668868ab0467f77260b46f99c73e7a88271fdd744",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://179c1384cfd27e35a3fb53353fb822612979dc2ba90d8ca7e12be7bdd75abee8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/fcba99f9-4c8e-4970-acbe-1d05ad6e6ac2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-997db25731efe826-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-92b8bf87781c923dd5684cbf9788c768-prefetch-dependencies",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "100733",
                "uid": "fcba99f9-4c8e-4970-acbe-1d05ad6e6ac2"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-yjhlyt"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-92b8bf87781c923dd5add63319b92dd3ecefcb18fe7cba2152-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-997db25731efe826-01"
                },
                "startTime": "2026-05-13T03:10:31Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f4fd734814dd5c4b593665910347d98e737e6b81f6fbf20e923d6efdc13b75ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:36Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://755337b79217bc9194636d98467a391f49ca559a848055478629c347a4ff93e1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:36Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cc9bccffa730eb9f90c0e465b6a8914bf257d74f4f5a87c1b14bba9cfa48de09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d256352c2815170ffc8b48fd82a1689be82d12bc027470f39c7179d68616b0e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/cdd20b2b-2fb5-4ce3-bda3-1e8d108f198d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-de917de948d01271-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:10:37Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gh-multi-951cf4a01e3937cef45c66b46f27780d-prefetch-dependencies",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "100574",
                "uid": "cdd20b2b-2fb5-4ce3-bda3-1e8d108f198d"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-cjiraq"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-951cf4a01e3937cef435bea5688d498ca7311c0099096d93aa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-de917de948d01271-01"
                },
                "startTime": "2026-05-13T03:10:37Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://94f6f6445f1420dbaf7b07963258df43fe6ca3506fa5f9704a3290fe2acfc767",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:41Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef13498639129395bff8e5f68d920dae9cb85c62b5500da5711aff3c847333b6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:42Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3494f6734a02d0fc6bf8a089820b71f48b2f50f748a621756fd4a522c74148fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:18Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91bf36d604eeef1cae74edcf7105f2b672e9d47ea6429c92367831266e0b85ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:19Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/59183f58-0c1e-4e0a-96bc-118db7be3cac",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-5cf424c9ec390282-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-co1df98efa73b8a70764b27c09b55d4801-rpms-signature-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "89501",
                "uid": "59183f58-0c1e-4e0a-96bc-118db7be3cac"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co1df98efa73b8a7071d2f27260804ab220438310c5f935d1a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\", \"digests\": [\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:38+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-5cf424c9ec390282-01"
                },
                "startTime": "2026-05-13T03:08:23Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://47c19bc7b3ae935125702982a910c30a3798656a12126c7310981a4785293f10",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:38Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4db83ba322fe92272f172fc30bcedfd593b6279fba930fd6659ab6f4831e1c04",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:38Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\\\", \\\"digests\\\": [\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:38+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/3baabd0b-0585-45ae-86ba-8991d4a8c8cb",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-a41d5b923cc94b99-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-co431dcc60ae2414c2956ed2c2cd0000c2-rpms-signature-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "109156",
                "uid": "3baabd0b-0585-45ae-86ba-8991d4a8c8cb"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co431dcc60ae2414c20cb6b0826ba137da3ec8cbcf897f56f3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\", \"digests\": [\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:03+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-a41d5b923cc94b99-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e7f78bc602b9795eb4c01c87e9f1beee4a61f15b2bc551bccdb730e62a7bdc08",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0485ccb79a233024314fd194626e1fbb0f2f41912def2c9b8bce855729f0d82c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\\\", \\\"digests\\\": [\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:03+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/4c08721a-847a-422b-8b2f-74f08ce61b3b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-dcdf32a2cab3e488-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-co7edb00f7eeeaee1e5eaf2c8960209707-rpms-signature-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "87554",
                "uid": "4c08721a-847a-422b-8b2f-74f08ce61b3b"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-co7edb00f7eeeaee1e04da514aeba7289962845a20f028b003-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\", \"digests\": [\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:06+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-dcdf32a2cab3e488-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f1e15c12d1808650aa02f467414451b4b702282cafe51b3a0297c8abf71dca07",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://519e72e91c41aea6bc72ddf4ba89efce2bcbd5fec3a3df31f0e6ba730f7e6394",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:07Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\\\", \\\"digests\\\": [\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:06+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/1a0e9da3-8d3c-4ff9-b1b7-c82632198b58",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-0b8fff90ca31a4c1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-com1df98efa73b8a70764b27c09b55d4801-sast-unicode-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "89022",
                "uid": "1a0e9da3-8d3c-4ff9-b1b7-c82632198b58"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-com1df98efa73b8a703dd0a55001730b148ebb05941a747d64-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:31+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-0b8fff90ca31a4c1-01"
                },
                "startTime": "2026-05-13T03:08:23Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e41f641c7e79fb165d1d40b1452c7ac14583a42c8d8b92122c5bb265ca3ce4f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://82e4ecb189c43cb058fced73bf7b71f58a2ae4f44a2c28f30a5cd74776882f73",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:31Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:31+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf942ace2949edf7539e55471f28d6550b3aa269dcea54fb66721a0ee88a2f4b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:31+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/34ebfbae-176a-4d98-8752-530c53dc18bf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-9bdb697b0a2f5788-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-com7edb00f7eeeaee1e5eaf2c8960209707-sast-unicode-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "87988",
                "uid": "34ebfbae-176a-4d98-8752-530c53dc18bf"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-com7edb00f7eeeaee16c4b8a935be5b82438bc4446578009f7-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:02+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-9bdb697b0a2f5788-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea8ea6f637ae8272fba464315f123d51cab13719779ff6ce1ddc17b4646a448b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://102ba4264ac89795442d8032a4b49834b586311dabe59432947c8da4c1646eec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:02+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://636759d868f39f60bea14af386c12e04ec8822f5830625f1f7e648b0ee6b1405",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:02+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/1f3606bc-9ed5-49d0-95f5-145ce72246b0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-18aa91cf96d2e160-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:11Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-comp1df98efa73b8a70764b27c09b55d4801-build-image-index",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "88618",
                "uid": "1f3606bc-9ed5-49d0-95f5-145ce72246b0"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-comp1df98efa73b8a76c30ba5728182834b73fe13654b55fd5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-18aa91cf96d2e160-01"
                },
                "startTime": "2026-05-13T03:08:11Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b52d96c8ee306df3a8cdadefff8efb8c9a54ab73c897f558c0d307f5a153667f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:18Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8ba6ce96d79f0e17bef9f2139a120dc162c4306e1cd3fd396d4dec0375276f09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:19Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bf4b9c507c229b2a524df8ed8e7b47a6aab2cfabbb1e07aebe225fcf43a6d330",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:21Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-comp1df98efa73b8a70764b27c09b55d4801-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/4ddbcc03-515a-4f71-8ce4-1e630ef63f9a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-e51eb61bb61d3874-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:34Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-comp7edb00f7eeeaee1e5eaf2c8960209707-build-image-index",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "86498",
                "uid": "4ddbcc03-515a-4f71-8ce4-1e630ef63f9a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-comp7edb00f7eeeaee737e26a7f252453122cd44bcef843fce-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-e51eb61bb61d3874-01"
                },
                "startTime": "2026-05-13T03:07:34Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1dab3ab474c65d89448c12bc9fee4d87cde6b0abd9fd7f741a4bc5daf4b080d6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://326a7dad91391011b0e0a52ac7effb633c825cde1b474ee2fb5d1f6dd3ecfedc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://543bfd7ede2701173431dd8097d028f61f49008117d1c273c63098919dbd1d37",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:48Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-comp7edb00f7eeeaee1e5eaf2c8960209707-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/fc2e98d9-6803-4694-9cda-1d8b3b2fece3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-7d65caadc63f4ed6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:00:58Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-compo1df98efa73b8a70764b27c09b55d4801-clone-repository",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "71087",
                "uid": "fc2e98d9-6803-4694-9cda-1d8b3b2fece3"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "revision",
                        "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tnfase"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo1df98efa73b8ab41b8601a8e52ff1e95e933431ee62a3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641144"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "a2cf3aa"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-7d65caadc63f4ed6-01"
                },
                "startTime": "2026-05-13T03:00:58Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e0a3763b9034c24dfd9e40536dae7322c12ce9cd30f506835abc147a6784c8d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:42Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641144\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2cf3aa\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c4ab4666f482b4d2b4c2ad6cec00b4678333d440c736da6b0c123654fe515896",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:42Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641144\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2cf3aa\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1d15bde2f1f06d756db69af754f19add00f8d8c4d30ef622d6338d64a7d01642",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:45Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641144\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2cf3aa\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/ad7927a4-1486-4bff-8d6d-fb36786dd9ab",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-508392afd36a1dab-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:23Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-compo1df98efa73b8a70764b27c09b55d4801-sast-shell-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "89660",
                "uid": "ad7927a4-1486-4bff-8d6d-fb36786dd9ab"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo1df98efa73b8a06b9aa728597438bbc8059f9d299bc69-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:43+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-508392afd36a1dab-01"
                },
                "startTime": "2026-05-13T03:08:23Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://05c1e2b1f8b47e5530058ac44dc89286224874021dea248d46dffbe1c83ecd0b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://70364f6478c07957211e1152199edd78389de5242b55bdf29c8b17d7797882bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:43+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f3fb67105d42e061b42e9da606ef8479e588ff4096afa1578f3571bcab2e52ab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:45Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:43+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/3610557b-e55c-404f-8a7e-17e3fa09291a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-ebe99ad61a7d9894-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:00:52Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-compo7edb00f7eeeaee1e5eaf2c8960209707-clone-repository",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "70161",
                "uid": "3610557b-e55c-404f-8a7e-17e3fa09291a"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "revision",
                        "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-mhgahl"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:19Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:19Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo7edb00f7eeeae4e8a9ee0216a2dc78d65a6161e180819-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641168"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "a2992e0"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-ebe99ad61a7d9894-01"
                },
                "startTime": "2026-05-13T03:00:52Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0c9463d4baac3128e7428cf7eca9ba9e0e59957978f37a63011136089454ed20",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:18Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641168\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2992e0\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0fae11187acebdf42e1810aba9c698256eeb515d2c88a594ea489dd40272c004",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:18Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641168\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2992e0\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://554bbfac107a25aed61057ea7182f78ead2e3d5b9cc8569e6a35c505e39b6f6a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:18Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702\",\"type\":1},{\"key\":\"commit\",\"value\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641168\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a2992e0\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/beead764-2151-45fc-8cc2-8f7206d10558",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-927f9a507c8f2ddc-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-compo7edb00f7eeeaee1e5eaf2c8960209707-sast-shell-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "87866",
                "uid": "beead764-2151-45fc-8cc2-8f7206d10558"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compo7edb00f7eeeaeab1035bbfedb89b5c2b95c1380bfb8e2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:11+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-927f9a507c8f2ddc-01"
                },
                "startTime": "2026-05-13T03:07:51Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://25ed1aa0da9d493f3a805c9f6bf976640ce98ccc9e9e71daa460c31eee5ba226",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:57Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6fffb4cfb95fc80786d49a7594d4bf4214cd38bdb828f67b9036714ac617af7e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:11+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://99c9cbaf6fcd24dd8498a614f9eab9bcb1b3fdabca68971e96b9db8b367702aa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:11+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/a1f19d05-9544-4416-b3e9-6e438b484a6a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-be2972aee2d9ec76-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:02:41Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-compon1df98efa73b8a70764b27c09b55d4801-build-container",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "87807",
                "uid": "a1f19d05-9544-4416-b3e9-6e438b484a6a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compon1df98efa73b890252f01ddc5d0f2e6e7309b68ee9585-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:319ff95d7b1acbe77793c6dff137b964b52b9ebe99caff08220c2c2c806a1708"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-be2972aee2d9ec76-01"
                },
                "startTime": "2026-05-13T03:02:41Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2234941a25991b50dce6c5c5112527c3cebf2008c9b5f38637457d1a252f7cea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://384723556ada6adeb41e3e987c90d69c864a59af3bfd9abdd3ab91eda2996499",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:18Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c45064b142b6ad4c3a4644084814c6dc6f4270cdb8be4f2cf5340fca9257fce7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:54Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:18Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3bdf02bb86b75d7bff87cc191df03ab3eb9d926fd233e0f6eb65548bb5a5017b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a71c49eb32f778d08a382949f1cd801e3ad97a82846a3fc5aa9fb13850a884dd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:38Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e570ace1e22b26717e45c5a2ca7dccb6015708d15cc19e8769936bb5269191e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:09Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915@sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:319ff95d7b1acbe77793c6dff137b964b52b9ebe99caff08220c2c2c806a1708\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:13c8742b8e02d88b5b57ba59f11d0af56f16253bd2fe17f150ae095fd4872a42=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-compon1df98efa73b8a70764b27c09b55d4801-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/0d07a878-5e3f-4eb3-8773-1b28bc58c3c9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-31b01c89cb2158fb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:02:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-compon7edb00f7eeeaee1e5eaf2c8960209707-build-container",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "85505",
                "uid": "0d07a878-5e3f-4eb3-8773-1b28bc58c3c9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-compon7edb00f7eeea7287d5b4a5b30f9349c9f17f807113b9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ffeb56e7522d9bb3f503495aa49ebd1023d1ba6f47e851223b5ab9cce2958e33"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-31b01c89cb2158fb-01"
                },
                "startTime": "2026-05-13T03:02:38Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6ec479b0a5c481ce34826c1bb1537913e5673f17345f4fd342208c556a9391d3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6563bbe62d8a2c8071fa16e59d6d000a6597a7161b9b19c77edfaa8d8fc1a653",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9a9a513705715efa8d0bf84882fd01e66fae15f3ed1e46409e7c0b00f1cd91f5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:22Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e87a329b76f72d9651f2260d04f97ea3afaa0ae9ad1bca8314c844400bce3cd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:41Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0c938250c03fce8433239ec7da67cd2a1a364723f31d1b14821e646710b2ed24",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:02Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1c9d0ba596ccb817445244e1445cd6117231b7f49cd71d71ff51531fa52c8b4d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9@sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ffeb56e7522d9bb3f503495aa49ebd1023d1ba6f47e851223b5ab9cce2958e33\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:f44231f602b2e57d784ce21a25d4e9c57ea124ddfc028d1d61dcfc64d283f702=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-compon7edb00f7eeeaee1e5eaf2c8960209707-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/6af738e8-e746-4e9a-a75a-0f1de6a5b5f4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-168480c0792e8cc3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-component-7edb00f7eeeaee1e5eaf2c8960209707-clamav-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "92727",
                "uid": "6af738e8-e746-4e9a-a75a-0f1de6a5b5f4"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-7edb00f76fe6cc76502545e228280e3a9b2eaa00-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\", \"digests\": [\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641765\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-168480c0792e8cc3-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cc5929811b027031cb3b951ad3ec6a0edd8122e12c8b8b455c0ea0c2433c02ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:25Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\\\", \\\"digests\\\": [\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641765\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e79d425311e416e8481dbb38ebd1a3ec2c47e30085187691cd7eb5585d4adbb9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:28Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\\\", \\\"digests\\\": [\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641765\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:26Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/aec8225e-2a2c-4db7-9994-5e67d2bd68b1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-070d4c516a06e6c7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:22Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-component-child-vcod-on-pull-request-4d52b-clamav-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "93288",
                "uid": "aec8225e-2a2c-4db7-9994-5e67d2bd68b1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc21fa8575424d38ca85db23bed124959c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\", \"digests\": [\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641769\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-070d4c516a06e6c7-01"
                },
                "startTime": "2026-05-13T03:08:22Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7549528a96eec8ea7df8a59a68f2019ab1f263d7462635e495db14182cf83573",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:29Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\\\", \\\"digests\\\": [\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641769\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e21da7cd0425fc1be832aaf0a2c9eecdc73485c1f9bf4ea9d3cdc8402bcda841",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:31Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\\\", \\\"digests\\\": [\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641769\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/d92eed59-808e-4263-8a78-b13363df9155",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-00aa0e394c283ef4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T02:59:16Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-component-child-vcod-on-pull-request-4d52b-init",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "69237",
                "uid": "d92eed59-808e-4263-8a78-b13363df9155"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:00:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:00:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-pull-request-4d52b-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-00aa0e394c283ef4-01"
                },
                "startTime": "2026-05-13T02:59:16Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a7b1921fbd49363a2328181a48dc6205bf2f3af25050a00f725edca6681ae722",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:00:55Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/commit_sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tnfase",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0/records/90a825fb-7170-4732-98ac-6803f406817b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"a2cf3aa7d35808a7eff08fab1467b37409c5b915\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-fcd3d3010e0b9b5fe8bbc608c56b1061-6e8321979bc47c87-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-child-vcod"
                },
                "creationTimestamp": "2026-05-13T03:08:23Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707158047",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2cf3aa7d35808a7eff08fab1467b37409c5b915",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                    "tekton.dev/pipelineRunUID": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "b3a5f7a844499900daecfacfb2617dde0390ed87140a1e5d6aa77fa4ee6de8"
                },
                "name": "gh-multi-component-child-vcod-on-pull-request-4d52b-tpa-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-pull-request-4d52b",
                        "uid": "7c9d541a-fbd7-444e-bb8a-3e2c900f68a0"
                    }
                ],
                "resourceVersion": "89537",
                "uid": "90a825fb-7170-4732-98ac-6803f406817b"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc03c16771bf70212cb4d21b41d389f9b9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\", \"digests\": [\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\":\"sha256:2112c163d97b5729cc8d42baea788e1d369607773a907387fef31c9f6ac05e64\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:39+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-fcd3d3010e0b9b5fe8bbc608c56b1061-6e8321979bc47c87-01"
                },
                "startTime": "2026-05-13T03:08:23Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3bcc5fe0a00253138d9e28f5a706dfbada8cf9c0f71db13b97d107d37ed1d0e1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:31Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13089cdb42dadafff44e626be02f378776490d8924ee68bb9f616d273eee169c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:33Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5fda71d63ad26c6a38b73c84ee0d9405b902b603315f32aa8b8237eea2f50a5e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:39Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915\\\", \\\"digests\\\": [\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d\\\":\\\"sha256:2112c163d97b5729cc8d42baea788e1d369607773a907387fef31c9f6ac05e64\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:39+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6db54d573129631fa7450f98e717e14f25145073137157d39d703da8adf6812d"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:on-pr-a2cf3aa7d35808a7eff08fab1467b37409c5b915"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/5c3bf44e-9e5a-41e2-9096-58d4bd1c90a3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-3dcfcaed4f6532b1-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-build-container",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "107011",
                "uid": "5c3bf44e-9e5a-41e2-9096-58d4bd1c90a3"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-9jwfm-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:b552c8ecaf011b92654b8835d0bfd49e5dd44ab1d63274d659d2814c91d56ed7"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-3dcfcaed4f6532b1-01"
                },
                "startTime": "2026-05-13T03:11:20Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a278aa1b947011491a06f6ac40f2c85aa3359aa0beacfc764662eb704da6625",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bec23cc242d39d2e855011da09a11dc70249f1bc8d2c1cdefb4828e27a87e082",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf52e93ecde49b4758e9fe3f83b5b92b5c7b6fe14734f2b815323860ef846a1f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:22Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e7c7e4f08ea3e7452f5d217800d3ff53a5644b9ca4a7d1a146ee1a8b5de57740",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:41Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8c0753b74e0126f81fb84bcfaba38231490033ba8c1f0d56fa9caca8ffbf1957",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:06Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2bb6c134dad62c24022996c044be8e422992982c6791070ade5b008614c1fd82",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:36Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:b552c8ecaf011b92654b8835d0bfd49e5dd44ab1d63274d659d2814c91d56ed7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-child-vcod-on-push-9jwfm-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/63aa9aaa-d098-4277-8365-8f46a21f8c7c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-43f349e78d347505-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:38Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "build-image-index"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-build-image-index",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "108150",
                "uid": "63aa9aaa-d098-4277-8365-8f46a21f8c7c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcf92508bfef4893799a0484a7cd7c0de9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-43f349e78d347505-01"
                },
                "startTime": "2026-05-13T03:13:38Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ebaec95118c91014dafcf965dee300bdbf4193ccb3b0151c3cc39f7b3b979e1d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4200b271221cc92f36efee7a7280d55768fe20636e095913a7f2d0c32f9f07bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:46Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0330a0e524a7583e6adee5fed9ee5c532b3d1dcaf864b98773816c1758826c0f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:49Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8@sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-child-vcod-on-push-9jwfm-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/514d3a3d-eae3-466d-b768-03a477d54cef",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-080696be400db965-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-clamav-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "112607",
                "uid": "514d3a3d-eae3-466d-b768-03a477d54cef"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-9jwfm-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\", \"digests\": [\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642101\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-080696be400db965-01"
                },
                "startTime": "2026-05-13T03:13:51Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9c70737591c5d74dbcae7976c81eb6d6d076a5d617a1c2b2cedd3fba451b982e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\\\", \\\"digests\\\": [\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642101\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://abeda23763f0385e957a2840d557a8759b6f1bc323721e1e7d9a31f1410ae287",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:06Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\\\", \\\"digests\\\": [\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642101\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/56091ce4-8c7e-499b-80c1-85352caa14a3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-21877db2a0245734-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:10:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-clone-repository",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "98127",
                "uid": "56091ce4-8c7e-499b-80c1-85352caa14a3"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "revision",
                        "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-cjiraq"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcba859f5227916fdeab8ce95cc45f6ed9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641799"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "8282141"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-21877db2a0245734-01"
                },
                "startTime": "2026-05-13T03:10:26Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e1b91da835a3bf5d44ab9603d0021a06d4d0bbf8a802820d864cc074847edf25",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:33Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641799\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"8282141\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf2fe41231ac2737d5e5ce852b84b3b06efb30e79b017d2847394f451bb70471",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:33Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641799\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"8282141\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://85966b690327f2ce1a4bf8a4fcfcf8343acb447796768bc4ec16dc053fc6f0ca",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:35Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750\",\"type\":1},{\"key\":\"commit\",\"value\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641799\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"8282141\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/98a971c4-dfec-48e5-a984-094506f43231",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-a436bf97ee23870a-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:10:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-init",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "97486",
                "uid": "98a971c4-dfec-48e5-a984-094506f43231"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-9jwfm-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-a436bf97ee23870a-01"
                },
                "startTime": "2026-05-13T03:10:20Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2fa0b99e2ee2b50338a5f6007f3a3da43909cfc6f59bda7dbc6477965f800b16",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:24Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:24Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/c34966a5-ce6c-4f8c-80d3-3014cf8344fd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-878b83d60939dc56-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-rpms-signature-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "109237",
                "uid": "c34966a5-ce6c-4f8c-80d3-3014cf8344fd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcd63b6c7f186888cbf81edee890279aef-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\", \"digests\": [\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:06+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-878b83d60939dc56-01"
                },
                "startTime": "2026-05-13T03:13:50Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b0ec7f8c07508f3a09423b48d12ddb5b66babdc149f5226d2092e596446ad4a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6f33b0228d72bf78f5491e75b9b10eeb96e25088017fd51bd708dfb6851117b4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:06Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\\\", \\\"digests\\\": [\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:06+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/9d3be865-f874-4029-a029-fb4579820ac8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-dd24af0b83fd1ed7-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-sast-shell-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "109906",
                "uid": "9d3be865-f874-4029-a029-fb4579820ac8"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc7fcbec56c087629d36c7f6813d5bf273-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:12+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-dd24af0b83fd1ed7-01"
                },
                "startTime": "2026-05-13T03:13:50Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5ac92c7ba1ab34a7a872a1a90e3cb03d66eb3eed7061e841a2368e90c8276b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:57Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://30359810ffbb309a26182566727a33c96eccd0f289f9cef3a60aff59d5848ada",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://24f6e9b24176df12abae80ced48465172a886facac7c2942887f2d00207d8af2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:12Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/3efd028b-78a1-4764-973f-7c08361c4de7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-3f6547469e51fe2c-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-sast-unicode-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "109015",
                "uid": "3efd028b-78a1-4764-973f-7c08361c4de7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc9f72219696e34e2d28d82db99bd81077-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:13:59+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-3f6547469e51fe2c-01"
                },
                "startTime": "2026-05-13T03:13:51Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://19fd449031cefa3b4f12bbc5947b8a364baa3b1089efa6d9695bc0a15ed14737",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:57Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e749c22e2be553e56fb98af7b885c231855ec4e97f55d0aa3b246897a6a02116",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:59+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://23b1a655d66e93931c111fe121614e868530bf2819072b2b4f013b406c8407eb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:01Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:59+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8c5d4bcbe3f09af7da3a7d6532219d9d0d2ced9c31e45e809609d4ab55bc6750=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/commit_sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cjiraq",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-9jwfm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nupdated to build repo image",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc/records/f8da91af-13e5-4868-a6d6-d5805e038eef",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"82821417b08d104e6363e85a8f3752321273e6b8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/6875ee0a-c08d-4424-b654-7b65529937bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8bc16804ee7cd4679fedd35a9c7fc1af-69ad253a327e3a1d-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708245363",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "82821417b08d104e6363e85a8f3752321273e6b8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-9jwfm",
                    "tekton.dev/pipelineRunUID": "6875ee0a-c08d-4424-b654-7b65529937bc",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-child-vcod-on-push-9jwfm-tpa-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-9jwfm",
                        "uid": "6875ee0a-c08d-4424-b654-7b65529937bc"
                    }
                ],
                "resourceVersion": "109945",
                "uid": "f8da91af-13e5-4868-a6d6-d5805e038eef"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-9jwfm-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\", \"digests\": [\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\":\"sha256:c619a559c97bc426314b5cd8026e562a5de603cefc360a1b1cb661d3fb20e2ed\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:13+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8bc16804ee7cd4679fedd35a9c7fc1af-69ad253a327e3a1d-01"
                },
                "startTime": "2026-05-13T03:13:50Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://627631a5d58c089a311c9de99324b3c7f5c66f8d794d23876dafc40086afa25c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b2f6d5170f2c2b200e0a900712acabf66eddb8c5b5785d7b3137c3d6c7ab2ace",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3e1014876bcb34f83a9f9200c9a98caa86655e745e46502cbba10cc9c420c49f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:14Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8\\\", \\\"digests\\\": [\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6\\\":\\\"sha256:c619a559c97bc426314b5cd8026e562a5de603cefc360a1b1cb661d3fb20e2ed\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:13+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:17e182e5cf7aa0736bd555550ddf2269138290614ba15f735ae240d6182165f6"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:82821417b08d104e6363e85a8f3752321273e6b8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/ea77dffc-9312-41ad-831d-eda647e27607",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-1f52ac71293a12f8-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:11:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-build-container",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "106716",
                "uid": "ea77dffc-9312-41ad-831d-eda647e27607"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-ljcbb-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8af8ff6d2d69707ba106b8f35623695ce7e2676b9fe61d064d39c63931dbd945"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-1f52ac71293a12f8-01"
                },
                "startTime": "2026-05-13T03:11:23Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8c88fd2a160c1305bf23a9975ef9283a06b9a575edb18e6632d77c4a65d6d032",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://089d6c9e7bbd3b31276d0016419f4d4c58d83dcab2a3ae3479006003e08a6e0b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b8de47d4ddf2706c15e99a2cf4e7d828d38a8e074a61fc33dea3b375b887159b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:17Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://388cd9a5b6cdd38f14689b620e0e093804f5da147d196e15f4302ebde10dc3e8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:35Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dc5c028970db9611fc2d14028861867b4c51ce90b2dfa72474b0f5f93bb3636c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:01Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://21757bd1f40670646359ee6b6283e5334d396a03c91a71fbffdafaac759834bd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:27Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:8af8ff6d2d69707ba106b8f35623695ce7e2676b9fe61d064d39c63931dbd945\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-child-vcod-on-push-ljcbb-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/a72abe55-1957-49eb-a5e1-e9bf16b8cae1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-916f9eeaa1ee96cc-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:28Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-build-image-index",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "107626",
                "uid": "a72abe55-1957-49eb-a5e1-e9bf16b8cae1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc019855e22b34dae6e5f09dd785222aab-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-916f9eeaa1ee96cc-01"
                },
                "startTime": "2026-05-13T03:13:28Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://51b108200035a028b8b5b8abbbf3d6ad81d1fd67fa3a98cbcaa23a5926d501a2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:43Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4c1cb664d68603b9d1e40f217218288faaa27545600944f7b2f0cc8e507571fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:43Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5b668bde4d681723128dfb7e252b5f129882c13ec90eb58dfc3650d69b665c40",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:44Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca@sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-child-vcod-on-push-ljcbb-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/011cd499-ce0f-44b7-b534-d0200b217e3a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-0788680936fcdf72-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-clamav-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "112726",
                "uid": "011cd499-ce0f-44b7-b534-d0200b217e3a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:09Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:09Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-ljcbb-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\", \"digests\": [\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642105\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-0788680936fcdf72-01"
                },
                "startTime": "2026-05-13T03:13:46Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3f3d790c7a5d300c2551117daf5c8c8417e05d091bd5100e0710163375c210fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:05Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\\\", \\\"digests\\\": [\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642105\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4320e63de5200e9d49a8529c797aa3ccb7bf7717666cbca56a3acb695e704c22",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:08Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\\\", \\\"digests\\\": [\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642105\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/ebe0e909-53f1-40ed-9f97-275cb0d07624",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-7514c5ea29664e5a-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:21Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-clone-repository",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "97660",
                "uid": "ebe0e909-53f1-40ed-9f97-275cb0d07624"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "revision",
                        "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-yjhlyt"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc3ff1355342dd04ee0fc0ac0e2cca0efa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641794"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "d6b4c8f"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-7514c5ea29664e5a-01"
                },
                "startTime": "2026-05-13T03:10:21Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0711432128df72df4939f89ddd583c02efb3fedf815e58d32b9d333d65902ba3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:27Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641794\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d6b4c8f\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f4645852a79e675d8fb2edd0ce4b94134660d3f310387e7cd6414939384ac538",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:28Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641794\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d6b4c8f\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b7c1ad8c9743754ce89048ff5130dcec8183e09a88550ed506350b7f21af5c89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:30Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870\",\"type\":1},{\"key\":\"commit\",\"value\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641794\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d6b4c8f\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/0bf1904e-5fea-452d-831f-50a0019cb374",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-7330eb65c2423605-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-init",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "97152",
                "uid": "0bf1904e-5fea-452d-831f-50a0019cb374"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-ljcbb-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-7330eb65c2423605-01"
                },
                "startTime": "2026-05-13T03:10:16Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://839a0f4d2e7dca73c15ae2be84d4e28d01c4a8721a4149397278cfb1f13fc922",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:19Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/07e5bc22-d1fd-4237-ae76-c836aaec7f54",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-754f6f760f81d38b-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-rpms-signature-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "109067",
                "uid": "07e5bc22-d1fd-4237-ae76-c836aaec7f54"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vca5ff793e1802bdc0d38b418c31c3cd12-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\", \"digests\": [\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:01+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-754f6f760f81d38b-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://36104c23d6d9300df41af55466eafd5ec7a1bbe30d53fb328adb6be5e6cd46a4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://652bed22e56e89e0c2fddd15af8cf14447f89f42c9947e356cfa629fee196dc7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:01Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\\\", \\\"digests\\\": [\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:01+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/d9694bae-cd7f-4aa1-835c-73ff05b41f3d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-98975f520ee9bde8-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-sast-shell-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "109701",
                "uid": "d9694bae-cd7f-4aa1-835c-73ff05b41f3d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vc8b77b8ffe2a6f4fc557878256855d43c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:08+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-98975f520ee9bde8-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://12126d5ad661e7a602cd3b3c3badf76f48762aae929d86978f5ef3dd8de7b867",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95e593e471ea1611f387512bb383f0b926287030f51247c97943c514479e4629",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:08+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b2b03716bde88be1593bd1912a4a4d95dd7a2282853cfef75cba0d09ecd72de1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:08+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/62990cb9-1f5e-483c-831f-0192a472358d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-9b80deac4fb2d601-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-sast-unicode-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "108355",
                "uid": "62990cb9-1f5e-483c-831f-0192a472358d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcb09ed8f38561da691995ca0522e5898c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:13:54+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-9b80deac4fb2d601-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0899df54b02832fba7ecf2539b9b0c114f48ceb967b15c6993ca74062929295c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e03075e8fcda773cdf93de1122d05d458c27c538cbd01f6c8db7507a4c22070",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:54Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:54+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bdeadba863739bd7256530c0e6d9bfa3343da844c6392afd7fd4f870100fc58d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:55Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:54+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod@sha256:7e6529951b6b29b1151956a54be2213302b61edc397e03dd5536f036a5932870=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa?rev=d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/commit_sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yjhlyt",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-child-vcod-on-push-ljcbb",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-child-vcod\n\nRHTAP-Qe-App update gh-multi-component-child-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa/commit/d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816/records/c820a773-b987-411b-a59d-f63dc564d0d1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-umyeqa\",\"commit\":\"d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/85e36e7c-b45c-4315-9432-154ee6333816",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c2e92fe0e81aad377096630697246204-eb1535171c598116-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-child-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708237200",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-child-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-child-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRun": "gh-multi-component-child-vcod-on-push-ljcbb",
                    "tekton.dev/pipelineRunUID": "85e36e7c-b45c-4315-9432-154ee6333816",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-child-vcod-on-push-ljcbb-tpa-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-child-vcod-on-push-ljcbb",
                        "uid": "85e36e7c-b45c-4315-9432-154ee6333816"
                    }
                ],
                "resourceVersion": "109205",
                "uid": "c820a773-b987-411b-a59d-f63dc564d0d1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-child-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-child-vcod-on-push-ljcbb-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\", \"digests\": [\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\":\"sha256:ab51d7a676b8cea0af0aab48d0a809a953860a3867a3d247f2155342a00e6b3a\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:04+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c2e92fe0e81aad377096630697246204-eb1535171c598116-01"
                },
                "startTime": "2026-05-13T03:13:46Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d25da7283282caa0fb75627575606a1de83a1b6538f7a9ece618e6dd61afee8f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1173727a8bd4d1d95eb79511735088b9b05b8e5963e81f6786088e431ed6853e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a53d5f6bbf06726fd16f89fd86b9b2c38e05545f5e112580c29c207c6817fb3c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca\\\", \\\"digests\\\": [\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d\\\":\\\"sha256:ab51d7a676b8cea0af0aab48d0a809a953860a3867a3d247f2155342a00e6b3a\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:04+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c1887947db7dec51443d6a2e6a7989ac3e4791999a632b2866d31312268bcc9d"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-child-vcod:d6b4c8fa39ec81bdb90105a9bc46438f84fd5cca"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/47a3547a-1f5b-47c6-8e5b-8c61c433c765",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-bda6bc9960e8f31a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T02:59:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm-init",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "68765",
                "uid": "47a3547a-1f5b-47c6-8e5b-8c61c433c765"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:00:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:00:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vcod-on-pull-request-lpjlm-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-bda6bc9960e8f31a-01"
                },
                "startTime": "2026-05-13T02:59:36Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5b6d5afca1fddacb05007efbfc0ee09477372c3a239021f560016fbfff61b989",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:00:50Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/commit_sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-mhgahl",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1/records/50210400-457c-47b9-b3dc-064184050b25",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"a2992e0d1ab681b63c1f398b65e9776c6867dec9\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4a75121a2782b5e849f41b1e3fec6ad9-9a0bc2c3e7e55933-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gh-multi-component-parent-vcod"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707195123",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "a2992e0d1ab681b63c1f398b65e9776c6867dec9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                    "tekton.dev/pipelineRunUID": "9ac85827-24b3-4b67-987d-e66674d53ba1",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "2ed67096c738a9bd132a42b6dec161d1e61bf031ea3673e4f5a67a7b77b6c8"
                },
                "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm-tpa-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-pull-request-lpjlm",
                        "uid": "9ac85827-24b3-4b67-987d-e66674d53ba1"
                    }
                ],
                "resourceVersion": "88568",
                "uid": "50210400-457c-47b9-b3dc-064184050b25"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v256a2620a500f67c195fcd0246c7b273-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\", \"digests\": [\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\":\"sha256:71775ed46d33c1d9e0aa987355187ce658ffd4e10b71b35c377e92d3fee73d70\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:23+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4a75121a2782b5e849f41b1e3fec6ad9-9a0bc2c3e7e55933-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e22df66e836116650899cdbf4589f6395a1154b0734e5bb76bd47a448ca5d93",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://96eaf4e5b4b02b459fbf4169e219b09556e4e0d550babb3b65ea6233335f035f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9a5c294205ef427bbf12a680b123d042c6e70f773d42efc64868e2dcd3e4f3c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:23Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9\\\", \\\"digests\\\": [\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914\\\":\\\"sha256:71775ed46d33c1d9e0aa987355187ce658ffd4e10b71b35c377e92d3fee73d70\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:23+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fe4de89ec1167f44d85a1f0213b77767fecdf2547c866c463f6be5fbe771d914"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:on-pr-a2992e0d1ab681b63c1f398b65e9776c6867dec9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/883535b5-a793-4b08-b120-e990c981ec4f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-6ea8a0d51e9b7f28-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:11:24Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-build-container",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "106747",
                "uid": "883535b5-a793-4b08-b120-e990c981ec4f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v85c854a651a33531c5899c7617814646-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:aec0402304936b66a4370af059fb83324217963a67055aa7703d62cf1d20d823"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-6ea8a0d51e9b7f28-01"
                },
                "startTime": "2026-05-13T03:11:26Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e63b77370aa2f0cea02e625d6e33fc51e7aa4e164b2d529e7a8a80ef9b9a846c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:31Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://73406f6d7f8753ab684acd7233f321551b64dc2eab0871426ceb87255fe2fc0d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://08acf3f32d9d82702d3763c33adead381bd34944ac5e0a073f1283691d07aca7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:22Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bfe6cf12439128a22a0cc3b72c0af2ca63b6c7dd12e162dae43f5ae421ee220a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:41Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9dcc554bf54a57c9d3731fef4d4c9dcd5e9662eb27fb8fd8671d8aedb02c5461",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:01Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e0830df5112cfa7957e15876ff6b86cd51efa8dd670ff886adc34c3d3135fcc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:28Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:aec0402304936b66a4370af059fb83324217963a67055aa7703d62cf1d20d823\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gh-multi-component-parent-vcod-on-push-z7v7v-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/6aafb526-e152-4b44-b1b5-6f5eef8e1e94",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-9ae4cba9b52e7aa1-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-build-image-index",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "107605",
                "uid": "6aafb526-e152-4b44-b1b5-6f5eef8e1e94"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vba719ce834db816af546eb9f2fb4b6f1-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-9ae4cba9b52e7aa1-01"
                },
                "startTime": "2026-05-13T03:13:29Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e5dcdf8d5ed609bbe82032d3c618176de97a6fcb5b972360ab7d431fbd3bfbda",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:43Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a945cbf8cbb6f8862738aae094cc7c35fab2a28de1f69b799fe995032f403de9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:44Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4c6fc31ff8b8199e898b8c2e6bf452c8c3e74702e2ab75828d906a507d653959",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:44Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08@sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gh-multi-component-parent-vcod-on-push-z7v7v-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/c2e4960e-e431-40fe-ab28-b108995ea67a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-cb2e6a68ef3d09d9-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-clamav-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "113067",
                "uid": "c2e4960e-e431-40fe-ab28-b108995ea67a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vcod-on-push-z7v7v-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\", \"digests\": [\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642109\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-cb2e6a68ef3d09d9-01"
                },
                "startTime": "2026-05-13T03:13:46Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e7e7242f9df3ee8fdb4b51164e8f8545502bd64e591a9253b35cbd6b88ddba5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:10Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\\\", \\\"digests\\\": [\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642109\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a83035ab91c921f21c539c8f7d7b6e87770ba9336fc3ebdca873359e59cebbf8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:12Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\\\", \\\"digests\\\": [\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642109\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/44baa99b-75f9-4016-9f77-8fb12c2eb821",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-bc1d449007b3e0b7-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-clone-repository",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "97857",
                "uid": "44baa99b-75f9-4016-9f77-8fb12c2eb821"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "revision",
                        "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-cweoci"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vf5132b6f7e6944c80f75ce3bd1523c65-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641801"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "600d69d"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-bc1d449007b3e0b7-01"
                },
                "startTime": "2026-05-13T03:10:23Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6e8da0b7894438f47c6b1d2482b44f8ab02516ea45bc21c7611ec53c8efdb3f3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:28Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641801\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"600d69d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1494d00d2536e2a6b1471e257205637cc701d583216a1780e589428acf318061",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:29Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"commit\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641801\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"600d69d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a74880e6914868dbf3a00331ad9d442c994b208875c8e8b764292f8b4a142f63",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:31Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60\",\"type\":1},{\"key\":\"commit\",\"value\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641801\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"600d69d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/8cee4031-b163-425f-8f67-943086bd6272",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-e8dc6e3858a55249-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:10:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-init",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "97305",
                "uid": "8cee4031-b163-425f-8f67-943086bd6272"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vcod-on-push-z7v7v-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-e8dc6e3858a55249-01"
                },
                "startTime": "2026-05-13T03:10:16Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8c42796587bc703a09677a3d7a28be5a23658c3e1af25bdda9d7f79ec77d1a34",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:21Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/f886617e-d024-4583-8c4d-417231804a19",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-7240858ee6170c03-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-sast-shell-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "109676",
                "uid": "f886617e-d024-4583-8c4d-417231804a19"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-v432fec09226fb251975def23b5f86613-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:08+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-7240858ee6170c03-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3922b0fa8b49737683c908a53f12a10548c40306a91b3b2e987642a2e4cf64f9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://64d84e452c2cc7c7c37cff657dae1295956a955119501bbf2f45775bf9e76025",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:08+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7c0772e898e95a7d5ffd36277162891e37cd299e1ef2d1d9d5c92eb7fbced192",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:08+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/69552571-7280-449f-ac16-b9e8a1c89f40",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-5a3291a0d44bd084-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-sast-unicode-check",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "108366",
                "uid": "69552571-7280-449f-ac16-b9e8a1c89f40"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vbd49215597750755fe95a887868e940b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:13:54+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-5a3291a0d44bd084-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://37c6f9978713ca61ea284632e94949b91e9acddbd69eea61542121d2a60236a7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea45ac086afc3b564f237fb4b7ce811f8e983e52cef8f2ae136628dbeef3ba90",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:54Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:54+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e082540b68a48ba8d27030a37161a7c0acf47311cfc1ab407bbd67b6e7284539",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:55Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:13:54+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod@sha256:ef938f008daa3669b547ee8e7200a497fc6a1d3c5ad8cc8d0928b7a1f5757c60=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/commit_sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-vcod",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cweoci",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-mpxn/tekton.dev~v1~PipelineRun/gh-multi-component-parent-vcod-on-push-z7v7v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-vcod\"",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-bots-2",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request #1 from redhat-appstudio-qe/konflux-gh-multi-component-parent-vcod\n\nRHTAP-Qe-App update gh-multi-component-parent-vcod",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa/commit/600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-vcod",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7/records/81e246b7-5f30-4a5e-8bb2-ee5d5388d180",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-umyeqa\",\"commit\":\"600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\",\"eventType\":\"push\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8d0c3e633740ea5350c91ed38cf68041-93ee9ae35788bfe7-01\"}",
                    "test.appstudio.openshift.io/pr-status": "merged"
                },
                "creationTimestamp": "2026-05-13T03:13:45Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-rgcb",
                    "appstudio.openshift.io/component": "gh-multi-component-parent-vcod",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/check-run-id": "75708238209",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gh-multi-component-parent-vcod-on-push",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.build-nudge-parent-umyeqa",
                    "pipelinesascode.tekton.dev/sha": "600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRun": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "tekton.dev/pipelineRunUID": "56a4aac0-7820-46a3-95d5-39f1f34e82b7",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gh-multi-component-parent-vcod-on-push-z7v7v-tpa-scan",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gh-multi-component-parent-vcod-on-push-z7v7v",
                        "uid": "56a4aac0-7820-46a3-95d5-39f1f34e82b7"
                    }
                ],
                "resourceVersion": "109056",
                "uid": "81e246b7-5f30-4a5e-8bb2-ee5d5388d180"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gh-multi-component-parent-vcod-on-push-z7v7v-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\", \"digests\": [\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\":\"sha256:616ab6da25e137556e6b88bc00db0235da96d4cafdc3f7fb4e912a7b3a8cd602\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:02+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8d0c3e633740ea5350c91ed38cf68041-93ee9ae35788bfe7-01"
                },
                "startTime": "2026-05-13T03:13:45Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://10a6d8036d885ab94ce1956fff89d333e7f1278a83352c1f511434905ffaed97",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://06e097cdfe35f565ff5e8021a5200f9a7d9cde958abb046875928cc63f1a1ed0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://989628ebb1727db505002bbb1cbfc0fbe17ec50d637bb2ba24cd46f4c6cdd0cb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:02Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08\\\", \\\"digests\\\": [\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b\\\":\\\"sha256:616ab6da25e137556e6b88bc00db0235da96d4cafdc3f7fb4e912a7b3a8cd602\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:02+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:26b72711e4617547c5b3598011fbe0babe385e7b260f2350862bcd21ce7e441b"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "gh-multi-component-child-vcod",
                    "build.appstudio.redhat.com/nudging-commit": "build-nudge-parent-umyeqa?rev=600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/nudging-component": "gh-multi-component-parent-vcod",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-mpxn/gh-multi-component-parent-vcod:600d69dad9e0aadccdcfdf5d3ae98d0bf595ef08",
                    "build.appstudio.redhat.com/nudging-pipeline": "gh-multi-component-parent-vcod-on-push-z7v7v",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-mpxn/results/3d3d249e-fda0-497d-917e-7c434bac1981/records/8cece92e-57dc-41fc-80eb-5c131ffe5da4",
                    "results.tekton.dev/result": "build-e2e-mpxn/results/3d3d249e-fda0-497d-917e-7c434bac1981",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7a004b5c3b42ee49a24298efa11d6be9-34fdf8b9d2f79b32-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:14Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1778642114-fd4db",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1778642114-fd4db",
                    "tekton.dev/pipelineRunUID": "3d3d249e-fda0-497d-917e-7c434bac1981",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1778642114-fd4db-renovate",
                "namespace": "build-e2e-mpxn",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1778642114-fd4db",
                        "uid": "3d3d249e-fda0-497d-917e-7c434bac1981"
                    }
                ],
                "resourceVersion": "121251",
                "uid": "8cece92e-57dc-41fc-80eb-5c131ffe5da4"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gh-multi-component-parent-vcod",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_75a10a08d4 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-vcod-8e04f.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_mpxn_gh_multi_component_parent_vcod_db03807b95','password':'${TOKEN_6c560fd5e6}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642114-fd4db"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642114-fd4db"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642114-fd4db"
                            },
                            "name": "renovate-pipeline-1778642114-fd4db"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642114-fd4db"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-13T03:17:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:42Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-pipeline-1778642114-fd4db-renovate\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:29a2f31\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1778642114-fd4db-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-7a004b5c3b42ee49a24298efa11d6be9-34fdf8b9d2f79b32-01"
                },
                "startTime": "2026-05-13T03:15:15Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:17:42Z",
                            "message": "Step renovate terminated as pod renovate-pipeline-1778642114-fd4db-renovate-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T03:15:14Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_75a10a08d4 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-vcod-8e04f.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_mpxn_gh_multi_component_parent_vcod_db03807b95','password':'${TOKEN_6c560fd5e6}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642114-fd4db"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642114-fd4db"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642114-fd4db"
                            },
                            "name": "renovate-pipeline-1778642114-fd4db"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642114-fd4db"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/a8e1cf08-a08c-43da-a5ee-1b657145cbde",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-a044fd338d803706-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-2e609c971e93a8aad575bae1eb989eb4-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "93692",
                "uid": "a8e1cf08-a08c-43da-a5ee-1b657145cbde"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-2e609c971e93a8aad575bae120dc3f5c5dd4ea173278da372b615ab8-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\", \"digests\": [\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:09:43+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-a044fd338d803706-01"
                },
                "startTime": "2026-05-13T03:09:29Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://92d236c50f303c6e9c38ba49680fb15b5c5c9424ddfd6a67546029885111453c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:43Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\\\", \\\"digests\\\": [\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:43+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/383066fa-33e7-49cc-b875-f342c3ad15d4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-ea1fd064ca9e9453-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gl-4ea93e161becfd51b519881dd286f721-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "117238",
                "uid": "383066fa-33e7-49cc-b875-f342c3ad15d4"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-4ea93e161becfd51b519881d846eda7e9cbf9422b3899fb6cac82959-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\", \"digests\": [\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:57+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-ea1fd064ca9e9453-01"
                },
                "startTime": "2026-05-13T03:15:44Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ff79949b8bb6445021bf7b3835e4362f833b7f9073275fac57db0198123a233a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:57Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\\\", \\\"digests\\\": [\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:57+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/b8c6325a-cfc5-4a30-8b8c-63a47f1332cf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-a9b2deac3230bd16-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gl-9ea4f86fb29935682f3020d3ddd5dd0e-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "111772",
                "uid": "b8c6325a-cfc5-4a30-8b8c-63a47f1332cf"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-9ea4f86fb29935682f3020d39a85da25335b7b594c9ba568ab84fdd4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\", \"digests\": [\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:14:48+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-a9b2deac3230bd16-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4e0b08b3ba4926028efb34deddd61c660bbf34af23a335bae7b7c5b01a193966",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:51Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\\\", \\\"digests\\\": [\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:48+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/4d6b853c-38fd-4158-9aec-92581067669a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-8eaf2d3204457375-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "gl-bd66f052069b34fcea4e2efd68375acf-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "120716",
                "uid": "4d6b853c-38fd-4158-9aec-92581067669a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-bd66f052069b34fcea4e2efde644e17d04ba4484c7c06b8d8b83d8df-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\", \"digests\": [\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:17:28+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-8eaf2d3204457375-01"
                },
                "startTime": "2026-05-13T03:17:17Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3eeb8908cebc269982e361e0f44722f965624b62ba93bd868f628dd2d4c3d678",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:28Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\\\", \\\"digests\\\": [\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:28+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/1b0e82e7-31b9-4c99-928a-81d09423d302",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-1bd27c3da71c05bf-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:48Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-bf600e9892006c21036164ee06f88c01-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "112409",
                "uid": "1b0e82e7-31b9-4c99-928a-81d09423d302"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-bf600e9892006c21036164eeb3070de2899c18b4338c0c00eabe661c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\", \"digests\": [\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T03:15:00+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-1bd27c3da71c05bf-01"
                },
                "startTime": "2026-05-13T03:14:48Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b70b8e8965426d290bd79b2397769a454d3421256567d987cd84e55beb177828",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:00Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\\\", \\\"digests\\\": [\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:00+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/52231a8e-b8fd-4dc6-83bb-cd384b0d9c3a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-67bf2e1df8247206-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-ec4f593f7d356a427ba775e71d1f41f3-deprecated-base-image-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "87933",
                "uid": "52231a8e-b8fd-4dc6-83bb-cd384b0d9c3a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-ec4f593f7d356a427ba775e7660202370a7ecb43bbbed990ac769944-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\", \"digests\": [\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:08+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-67bf2e1df8247206-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1723f002900b2d624942064fa670e5b4f07c511c3694baf87d9c52ddccef1e2e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\\\", \\\"digests\\\": [\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:08+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/6f85112c-c218-4a0e-8bd3-d7ded1fcf9fd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-74a2f3f217ca9fe2-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:01:48Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-2e609c971e93a8aad575bae1eb989eb4-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "77234",
                "uid": "6f85112c-c218-4a0e-8bd3-d7ded1fcf9fd"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-kucnkn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:04:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:04:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-2e609c971e93a8aad5271952091e223723c741ef45ae489b9c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-74a2f3f217ca9fe2-01"
                },
                "startTime": "2026-05-13T03:01:48Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2cdb3bef324c6fed3e538b38a1f2282000bbbda74981eb3e5a9d8d196bafa491",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ed5756299b34f52f666d037554fb267c71308a058fdb1857ba7e2eb682ffa0c7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1bfee44f15c91c7ea7d3d5efc24dbc58a2f25062c35f06212be68d6a3aa9fffd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:06Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://151e749290fe7c17837045a28cf04b7ed47cfa75c1ae9e45d9d79859433bad5e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:20Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/1c803542-d18d-4d70-b1bd-5508b16ea208",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-7fc7849a076955fe-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:12:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gl-multi-4ea93e161becfd51b519881dd286f721-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "105821",
                "uid": "1c803542-d18d-4d70-b1bd-5508b16ea208"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xhzqjx"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-4ea93e161becfd51b5795b89f47f145c9f126034d8ac938521-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-7fc7849a076955fe-01"
                },
                "startTime": "2026-05-13T03:12:17Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://52ec9c0ae236b0754485b6a1020205802ea1b828205f487ee07137933787d93d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:23Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://736933c04a81099747de6bd34174aa0b956c1bce0402d6572cabffe04be7f31b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:23Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://08e1d922b5fddc07ceaff46f4546eee6066efb9893d62089bf17f9b61278ef6d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:02Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://79dfe8bf4bce449eb4aab7a4e770b0720a177101e92886a528100cfe390c94bf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:03Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/584f2349-be3d-416e-b650-95a67d561cfa",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-66d3650563ca47b3-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:00Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gl-multi-9ea4f86fb29935682f3020d3ddd5dd0e-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "101741",
                "uid": "584f2349-be3d-416e-b650-95a67d561cfa"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xqxzcx"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-9ea4f86fb29935682f83699d7da2a8d4ce89464ff13f6e6673-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-66d3650563ca47b3-01"
                },
                "startTime": "2026-05-13T03:11:00Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://04ddf1399a942377a08ed0571373e3c63f0ed7d930f58cc822e1c2ff6d9bbc15",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:07Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7f9fcd9a5e8bc3b4c330c54621b83e7bb4c80467c1e3b95775410ca45a5cd144",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:07Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://54559c0a3a9f824420feb5834fa41f9e9aca0c42ddea70a27d9e8895b8f8354d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:43Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://abfdf3a9cfad77ba04f413c77af7175a2d451f9fc44739fd3064e04a25f67c84",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:43Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:43Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/dc32bbd6-af77-4731-8942-8a6af9a0ff1c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-c66da0748f19a2b8-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:12:21Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "gl-multi-bd66f052069b34fcea4e2efd68375acf-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "106045",
                "uid": "dc32bbd6-af77-4731-8942-8a6af9a0ff1c"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-uroneu"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:13:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:13:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-bd66f052069b34fceaef8c126413fc528b05a1d84a14222718-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-c66da0748f19a2b8-01"
                },
                "startTime": "2026-05-13T03:12:21Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b4096235180703155e33e9bbd36365c8a8ffcd3dd700e6d6d5bd354a904ec5d1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:27Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6838814693c02d31d22e2aea95ebca21e2db9889c90748cd7c38d1197c5f94c9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:27Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://136c21c263892f2521c74f3349117c571f7f3b78300df0ca4c3ccc6284481ff5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:07Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1aadb5a267e03fa0d93b109ea890c24b3bbf9ba950549e63c6248eaf96786573",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:07Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/a34ab595-9afd-4c3d-b60a-c8857747647a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-14e1ba344cbb6506-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:11:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-bf600e9892006c21036164ee06f88c01-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "102584",
                "uid": "a34ab595-9afd-4c3d-b60a-c8857747647a"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-omeooo"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-bf600e9892006c2103041b748fe2e4a4b5d18f934816a63b55-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-14e1ba344cbb6506-01"
                },
                "startTime": "2026-05-13T03:11:07Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://317adc5f84638a10a23573f37ece0d459ad2c15109facff8d1bf2386cb6fef5f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:12Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bb438857d5d089bc8caa07f2575082b5445e5d231d978a9ddb160bddb04e689f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:12Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a6b8d661e6149eb025a1855cd2d31e244ca1a4dffcaed832bebed582541bc72",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:57Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9d1bf71af01ca07eca91a7b2b01ba74be8cb1d50088afcde6e64edec05ea5fb1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:57Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/12d1d0d0-68ad-470d-b436-61dd39edfd3c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-de444d15047dd2b6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-co2e609c971e93a8aad575bae1eb989eb4-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "93817",
                "uid": "12d1d0d0-68ad-470d-b436-61dd39edfd3c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-co2e609c971e93a8aaaafc317e3f90b1ffd70ba59259943ea3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\", \"digests\": [\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:09:46+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-de444d15047dd2b6-01"
                },
                "startTime": "2026-05-13T03:09:29Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3f4ebf7a029763a2a46535967701c8dc55118037dfb855e4237baa9b4de64752",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dd6a9ab91c7f35363b52c2465f420b495a75c7943fdd16bb81463bff61bd3daf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:46Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\\\", \\\"digests\\\": [\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:46+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/bf5ebb7c-73d4-4ca1-b249-d75134dd8513",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-e94663319921e348-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gl-multi-co4ea93e161becfd51b519881dd286f721-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "117394",
                "uid": "bf5ebb7c-73d4-4ca1-b249-d75134dd8513"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-co4ea93e161becfd51d5875dd02c2a460c2d263f009131c743-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\", \"digests\": [\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:59+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-e94663319921e348-01"
                },
                "startTime": "2026-05-13T03:15:44Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6f015cce4fbf8a4fe16e798c309d223d7aaf1404af1107046200227e4a0d72b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6ca1fbed9968415937e3cbafcf6c8b0d0002816b39f20231e45687a4e38ab8dd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:59Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\\\", \\\"digests\\\": [\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:59+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/bb8e35b7-febf-46ba-85df-32a34d1bb49d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-316029d38a234236-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-cobf600e9892006c21036164ee06f88c01-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "112540",
                "uid": "bb8e35b7-febf-46ba-85df-32a34d1bb49d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-cobf600e9892006c215dcb4ffaf0243b8a2b252068414d2290-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\", \"digests\": [\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:04+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-316029d38a234236-01"
                },
                "startTime": "2026-05-13T03:14:49Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a86a6e4bb39f20713325bce16531331db75d068ebe637162b27620f754e65b5b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:03Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6f3ffaa52d433a215252c75941125dd9c1e811e6e1fe447887b194ce845f07f3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:05Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\\\", \\\"digests\\\": [\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:04+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/738252c8-d771-46fc-ab74-75641018178c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-e5e5b8bcff072140-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-coec4f593f7d356a427ba775e71d1f41f3-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "87551",
                "uid": "738252c8-d771-46fc-ab74-75641018178c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-coec4f593f7d356a429506bbf653185417a47ef04fd32a8abe-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\", \"digests\": [\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 106, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:07+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-e5e5b8bcff072140-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5adbf48e1cb7aa56b3aec5181795ae7cf4a7d12d229164571fe7387b301cd374",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://682bc841cb6387017fe2305ecaf7bd14e2dcd92a4bb2a855696c2b0349e42c76",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:07Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\\\", \\\"digests\\\": [\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 106, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:07+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/91901fbc-1b29-4035-8f0d-4b8ddeb7feca",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-7bffccb0908bc5ff-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-com2e609c971e93a8aad575bae1eb989eb4-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "93589",
                "uid": "91901fbc-1b29-4035-8f0d-4b8ddeb7feca"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-com2e609c971e93a8ab6756866dc5e69b85b9c6f4a1fab676d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:09:37+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-7bffccb0908bc5ff-01"
                },
                "startTime": "2026-05-13T03:09:29Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://34f45b91a2335583f4a1338032ed29f44af10eacaafcfa1ae994fce65d5b94b7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9a0aea0a62aef51175d278e06f931b3e2716d75cba8a61ab0bd87c4edaca2c34",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:38Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:37+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a535b3b05576cd6e7130d654f8b6d012919ed0f501068b626ad62a1bd22fe029",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:39Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:37+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/49f4e5a3-194b-45b7-a1d3-a3a0ec56899e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-438e9df832f638a5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:48Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-combf600e9892006c21036164ee06f88c01-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "112341",
                "uid": "49f4e5a3-194b-45b7-a1d3-a3a0ec56899e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-combf600e9892006c21865aa329da76ba2f1e74ddfe556b204-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:58+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-438e9df832f638a5-01"
                },
                "startTime": "2026-05-13T03:14:49Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fbb73c42b9409a159da5acac1a830f67456707c586d1934fbaafc3ff529e8399",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f4c493b68e8f73e739681b7813185ae04f20a5e0b8249062d8c11cd3785d6b4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:58+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9153494457e42b65b1c2f8bbe8050bde8559ab28100d4a1c0fb83910ca916624",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:58+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/af72336d-a00e-463e-a4e8-dfd7ac0745a5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-58d9645becc91538-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-comec4f593f7d356a427ba775e71d1f41f3-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "87125",
                "uid": "af72336d-a00e-463e-a4e8-dfd7ac0745a5"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-comec4f593f7d356a4559aad7f1bff993f8ab25cc14eb91aa4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:07:59+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-58d9645becc91538-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e40d8fd7b833026c933cd72828f48fbc355765bb9ae71ce42b5d2c16fb61770",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:57Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df900c51ef4886d73111d32974b3418a972eec4a97dd6bfa99942186ec6466af",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:59+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5e024cab2a40a6f83ad8f4ac2eaad65a9668826656e92d8ebeec0861f3caeafd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:01Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:59+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/03708a43-94d0-4768-868d-0dd7ca82296e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-3a6ec48be67cb216-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-comp2e609c971e93a8aad575bae1eb989eb4-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "92918",
                "uid": "03708a43-94d0-4768-868d-0dd7ca82296e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-comp2e609c971e93a848ce23326d4b00410a6412478db2b2b2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-3a6ec48be67cb216-01"
                },
                "startTime": "2026-05-13T03:09:17Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7745d8775368660724e7b288bde8f0d2cdfc79a9935b0ba48ce10ae586b8a7bf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:24Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://749cf2c1509a619b83f8f27fff20a1c6f8058a0d1b4b231fe16973920fc65b3f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:25Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5b3230fa9dbc00f763538c9c604d959515b3a41050fe5d08dafebde9a7c12c0b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:27Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-comp2e609c971e93a8aad575bae1eb989eb4-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/d3d960c1-a5f3-4109-8ae4-8a1215409e4c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-ba6c59265cff8f0f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compbf600e9892006c21036164ee06f88c01-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "111695",
                "uid": "d3d960c1-a5f3-4109-8ae4-8a1215409e4c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compbf600e9892006ce7d9d6e2dacfe4d9a7ab20641c6bc0ab-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-ba6c59265cff8f0f-01"
                },
                "startTime": "2026-05-13T03:14:37Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a9e2d28fe8252449a6899feb4a0474b1eb07097a76c3fa8c5d296b3e319d5fb4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:44Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b1a791fe0f1f372ce3124e77b30454fd131d0b96dda4d72cde46daff3ff1aa98",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d17266653314476ddf5019491865424b07a534616440fad7d5a270efa55c177",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:47Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-compbf600e9892006c21036164ee06f88c01-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/65f33ac4-d9c0-4434-ba02-d1d172427fb1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-363a32aa571cb9b2-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:34Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-compec4f593f7d356a427ba775e71d1f41f3-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "86532",
                "uid": "65f33ac4-d9c0-4434-ba02-d1d172427fb1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compec4f593f7d356ac5dc3fd9e0e6fcea73c09812e38598f2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-363a32aa571cb9b2-01"
                },
                "startTime": "2026-05-13T03:07:34Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0de607b611e9ebfe4831f9e52d81b0b6c05ee4d48fd2e64d081818ba9319c34a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cdc6f0800b8ad8a6ac7c44e3d077ea45ff368f4bbd7d2aa12fca7c78ea102b4d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:45Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://78de737920a21b09a101d0683db7ee66c06b6722e9a59d0486431504e3bdd309",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:48Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-compec4f593f7d356a427ba775e71d1f41f3-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/44e49fff-1863-491a-8fb4-535ec884fa71",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-572a6a483847f866-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:01:12Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compo2e609c971e93a8aad575bae1eb989eb4-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "71182",
                "uid": "44e49fff-1863-491a-8fb4-535ec884fa71"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-kucnkn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compo2e609c971e93a3b0b21293ee63c1c3ba2212e48e878ac-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641152"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "4404b94"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-572a6a483847f866-01"
                },
                "startTime": "2026-05-13T03:01:12Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://82d1cd4278293eb60ac8e62d5b1042657db87585dce7527eeaf3848ae7501507",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641152\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4404b94\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d6dbb8864b38eaa5c6cd57517e24b7c879d4d61dde05ba52051c6ab3c888b41f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:45Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641152\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4404b94\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a2977f2b1d7af8b016908f0bb3c87b9562d071f1ba3b4069bdccb4e9865b6c1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:46Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a\",\"type\":1},{\"key\":\"commit\",\"value\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641152\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4404b94\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/b4254749-5aa6-4664-be72-10b6a0e7b909",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-dd110c983a39a6f4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compo2e609c971e93a8aad575bae1eb989eb4-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "94043",
                "uid": "b4254749-5aa6-4664-be72-10b6a0e7b909"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compo2e609c971e93a8292d46247938598bd9d0b7d3550b62e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:09:50+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-dd110c983a39a6f4-01"
                },
                "startTime": "2026-05-13T03:09:29Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f295aa075c277aa737e9017bec43472441c8ab4ee2ef7415d65d3f58471e852f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://61914d231104e4fda3767b7fc3667484b62c145b6a71d45bcea9d7336b812faf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:50+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://de6e134097faa4e056f4d32ecec89bfffe2901d0c389ba378ea3dcafabaddf7c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:52Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:50+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/46936827-95d7-4b85-8e7e-b3a4145c84af",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-40d3e27e88a8d497-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:10:58Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compobf600e9892006c21036164ee06f88c01-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "99754",
                "uid": "46936827-95d7-4b85-8e7e-b3a4145c84af"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-omeooo"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compobf600e9892006a091c7482af0614a6f81d43e8b52dd84-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641841"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "9e7a7f3"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-40d3e27e88a8d497-01"
                },
                "startTime": "2026-05-13T03:10:58Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef67da1847f622d196727d80b3f32304fa1a933da711dc498fd7f5068a1750c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:03Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641841\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9e7a7f3\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b40f60038b4234fbbf155335cdd6d6267d3f289fc738efdcd689c8a190910ed0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:04Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641841\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9e7a7f3\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dcfbd34c638ad12859012e91eef550c13c202c34f7c7d5d3603692f140425b4c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:05Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3\",\"type\":1},{\"key\":\"commit\",\"value\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641841\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9e7a7f3\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/e12aa393-cbb4-4957-8567-fde81a6d8fd9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-8ecd0a09dc6ea5cd-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:48Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compobf600e9892006c21036164ee06f88c01-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "112897",
                "uid": "e12aa393-cbb4-4957-8567-fde81a6d8fd9"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compobf600e9892006155eeadb08409375fdfab5fb8d438f86-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:09+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-8ecd0a09dc6ea5cd-01"
                },
                "startTime": "2026-05-13T03:14:48Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://58fb9afe8ec5a035e82e60e45e817e49120d9ddb43c34d6c320354cca1a8c2f1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e052e59be75fd66a343eb73bc910da7dc16c5d962c96df678f9ed5a2e66fb000",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:09Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:09+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://245f88eb4b3fdb269d346b3ca82bcbcb2912c015368511d42326002cee498927",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:10Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:09+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/9b95ca59-29e1-432e-b212-4d5248016936",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-ffd679cf8f095d16-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:01:05Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-compoec4f593f7d356a427ba775e71d1f41f3-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "70884",
                "uid": "9b95ca59-29e1-432e-b212-4d5248016936"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wyxccw"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compoec4f593f7d3568bfee645ff9bb7f1358b7fddf944b136-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641175"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "2ffbfd5"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-ffd679cf8f095d16-01"
                },
                "startTime": "2026-05-13T03:01:05Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91784a8fa8d2cd834b52fbb01a4976d72094b231a4e983f4fb50a472eb10c726",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:42Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641175\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2ffbfd5\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ca9b1fbaa7b0f272a8e91a8abff3148781bc4f19b77a1ac12656739441936ad6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:42Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641175\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2ffbfd5\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3a926fa213c27fd30f310f773ea4bb8ad16f5c1a53388cb8f792657c8498d51f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28\",\"type\":1},{\"key\":\"commit\",\"value\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641175\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2ffbfd5\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/58d8a07a-c011-46c0-a30a-59ca959d457a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-35200bfd92239a33-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-compoec4f593f7d356a427ba775e71d1f41f3-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "88026",
                "uid": "58d8a07a-c011-46c0-a30a-59ca959d457a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compoec4f593f7d35666853379b4f46691208ed06ba95e073a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:11+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-35200bfd92239a33-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6337e8030f7ef4018e793f54f739b322693ef5cfd1eb852a098dd070f2084c1a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:59Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4b6e00adff813f1c2b98975817efad2a80ee4069bbc5ed96d56d98fd73be28c8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:11+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://25212b0ccdf5081d5d55a298273be28a8f2dfd8a8c82019b90d555382d1d5d61",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:11+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:12Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/23a7865c-51d8-4488-96b6-4b452a3d91a5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-489aba4a7a6e1b93-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:04:22Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-compon2e609c971e93a8aad575bae1eb989eb4-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "91467",
                "uid": "23a7865c-51d8-4488-96b6-4b452a3d91a5"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-compon2e609c971e93f7885951fa1c6d5b7707403d676889fc-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4a2c318479c4d10b693df6756e79045fbe18bd06f16e82ba5a00c7e198bdf9fb"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-489aba4a7a6e1b93-01"
                },
                "startTime": "2026-05-13T03:04:22Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13614d16ade03f15e11503c279f640356357bc44839559827ea0f7900f361fa7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:46Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f43e29f69b9861dd7874789fe51ee7ca2390b64350c4d3c6765e4acd0a254d1e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d8169ac545932f33baaf6232ebb690698f84fd2e0fb1d3374fbd1659cdaf9a2a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:41Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf72fb4e14f4c95a4fb5f29ca57b6772f2cf146d601d6ee6f483af58b3fba74b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2f3053b6b2e585d2019062eff4df21e2439e19748b8be23bdb10d68c9f4f436c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:38Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://88a68814ba4a2f422b5cf48c729c8198cedce8f318ecc93897bf742bedf2360f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7@sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4a2c318479c4d10b693df6756e79045fbe18bd06f16e82ba5a00c7e198bdf9fb\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:4500e467914afd0812ef6b50d2a86f8d6da5f8f84441059cc7ea9b628450171a=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-compon2e609c971e93a8aad575bae1eb989eb4-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/dd4fa7ae-ae3c-4b26-a681-fed6ae3de752",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-ed3a5afdd628b430-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:11:58Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-componbf600e9892006c21036164ee06f88c01-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "111085",
                "uid": "dd4fa7ae-ae3c-4b26-a681-fed6ae3de752"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-componbf600e98920078ae3d241f02936c87b6c81922b6ff4d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:0ce1ad8296f5644a42d3d02bfef72bc5565c4153ea8baf412094fe12f36b3597"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-ed3a5afdd628b430-01"
                },
                "startTime": "2026-05-13T03:11:59Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://20d54ef8095c4948a24ac27549e375f25698294f084a17ef013ea98ff42aea83",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2083302c4525d4bd9a4fd13f417577bc2f138b0209123e185c7e887d4c04f820",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a6a0654d735d16e6d7d2ddbea8b0706ee4914d262ab184ddf6696c0f54382c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:09Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a4be5df978a5002a4dbcf716d3dbbbf70726281c54bc64b3d3b1cf1b225f6a82",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:32Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2eed4fe8603b6475654c65b41c1450c7cd624f1066b97ef5ceb7ae7fddcc50f4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:03Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://317b29d685982dd4a6cfe8f500f9ca2b76f6c76143d9594af3a88fee040dabe8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:35Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148@sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:0ce1ad8296f5644a42d3d02bfef72bc5565c4153ea8baf412094fe12f36b3597\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:62104095f746d9ec596994a63d570174b372dd948565343ed5169480390a58b3=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-componbf600e9892006c21036164ee06f88c01-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/f43100cf-fa0e-47fe-a7c4-38088064f253",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-343ddb227979aaa0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:02:41Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-componec4f593f7d356a427ba775e71d1f41f3-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "85509",
                "uid": "f43100cf-fa0e-47fe-a7c4-38088064f253"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-componec4f593f7d35468a3156c811837b33427657abfec1ad-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:7972e7f5b50d27dd0804e5af0fe6de0d9da4cd6f0dd4243acb4e989eb8e3e6ad"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-343ddb227979aaa0-01"
                },
                "startTime": "2026-05-13T03:02:41Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://712ab73e1becbd8db6616a9fddc2cf8eb118c065849410b0c695d8f015bc768e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e5104f3b283c12176e1074ba7998a7f94a6c1eb5c8fd6bd587a63e0129cd600b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://02e925818b33d81866d3842ea0a011fd642e2690868c4350f9475905bbbe602d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:21Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0f9cf328a2fe3bee145ba46a5fd330def21b73376fe38ef07aef61c4bb7d5fcb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:41Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b8328d98a80c22df2cbdd530a3adb855797a6644baf6460199308876b697f77",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:02Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a9481f85150b6fb92ff848ea188e5704f5826eacc837fe4d907d97d4d92d8ef5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589@sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:7972e7f5b50d27dd0804e5af0fe6de0d9da4cd6f0dd4243acb4e989eb8e3e6ad\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-componec4f593f7d356a427ba775e71d1f41f3-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/da15075a-461e-4896-9a87-c754b45805fa",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-c6410b47361242e3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:48Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-bc9bx-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "117299",
                "uid": "da15075a-461e-4896-9a87-c754b45805fa"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pad00ea9c4b81452526dee6f6f2f505a81-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\", \"digests\": [\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642155\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-c6410b47361242e3-01"
                },
                "startTime": "2026-05-13T03:14:48Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://187cb779373f50f52bea1e3435294dedd1361d42b9eea0c3a0560a8617d5c222",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\\\", \\\"digests\\\": [\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642155\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c11c3fbf200ee03f9ffa92aa7f3cefa1d53093183b8c379735ed4444e48a1165",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\\\", \\\"digests\\\": [\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642155\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/7098a7dd-898b-420b-9a74-dc0f5d4fe9cd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-fd437db7a112d854-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:10:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-bc9bx-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "99361",
                "uid": "7098a7dd-898b-420b-9a74-dc0f5d4fe9cd"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-pull-request-bc9bx-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-fd437db7a112d854-01"
                },
                "startTime": "2026-05-13T03:10:54Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d74332784758e9a38af9b451770c0d7e3743968d6b1b4b6ea57bb04b46db1186",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:57Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/commit_sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-omeooo",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963984",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296/records/22f3055c-a504-46c4-bdce-1f53657459cd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"9e7a7f327720324797166336850eb9d1575f8148\",\"eventType\":\"Merge Request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-766d7b5f6ef157e8a4ed1d2747e649e9-f368283064bcb557-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:14:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "9e7a7f327720324797166336850eb9d1575f8148",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                    "tekton.dev/pipelineRunUID": "7f0cd44f-886b-445a-b0b0-aa79f351c296",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-bc9bx-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-bc9bx",
                        "uid": "7f0cd44f-886b-445a-b0b0-aa79f351c296"
                    }
                ],
                "resourceVersion": "112564",
                "uid": "22f3055c-a504-46c4-bdce-1f53657459cd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa6fd2d1a1fe5f59595370dc223c2c447a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\", \"digests\": [\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\":\"sha256:4194c76c76aa7d43beb66a899ee07c3352c9b18cd3822bfb04dd98c1aa608f8c\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:05+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-766d7b5f6ef157e8a4ed1d2747e649e9-f368283064bcb557-01"
                },
                "startTime": "2026-05-13T03:14:49Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d2de1cde63c932ef148f911332144bf0fafb11f4e0b4f7b144e4853e86d44e11",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d21f2eb0ef76a2edf918f9ad7ccdc5ac5f1def6de0b96f715ddc6d68f68fd1ea",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a1500fdb62790b6dadf04a3293d0df8bcc027e2bcd63964a8453022f4c05e6e0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:05Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148\\\", \\\"digests\\\": [\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e\\\":\\\"sha256:4194c76c76aa7d43beb66a899ee07c3352c9b18cd3822bfb04dd98c1aa608f8c\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:05+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:e9ef49c73d6af0e1ff333ecb6819143ac506fd8b4065e37e7a067883f4e7740e"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-9e7a7f327720324797166336850eb9d1575f8148"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/7d5a9906-0836-4033-a463-f059fdc7986e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-3d02c8724b286280-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-sqk7p-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "98105",
                "uid": "7d5a9906-0836-4033-a463-f059fdc7986e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa08410084cc7bf2e59dc4cf7712e5d494-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\", \"digests\": [\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641833\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-3d02c8724b286280-01"
                },
                "startTime": "2026-05-13T03:09:29Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b6368a569aaa176e8233b3f82ebf7b998ca30ce8cda1aaa833931e83e05f96d1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:33Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\\\", \\\"digests\\\": [\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641833\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7047c47af5c87dd7ebd5c7f5d388fad337d88233f031f42f06153f0dbeb7c56e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:35Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\\\", \\\"digests\\\": [\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641833\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/6737e657-a6f1-41e7-9d46-cfa0aa7031ed",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-c12e996cbffb7e85-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T02:59:22Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-sqk7p-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "69963",
                "uid": "6737e657-a6f1-41e7-9d46-cfa0aa7031ed"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-pull-request-sqk7p-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-c12e996cbffb7e85-01"
                },
                "startTime": "2026-05-13T02:59:22Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ccfa4cd0933001fcadd74d5f3a8328759cb1fe3b7ea0506ca8af88af980c8444",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:11Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/commit_sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-kucnkn",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520943746",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-child-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc/records/85fe2191-0d51-41cb-bef7-0305c6f0d16e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"4404b9441856da0c79620d449b5fb17a0e640ea7\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-278d045a37c56152566640318236986e-b2bc4f0831b0b900-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-child-payf"
                },
                "creationTimestamp": "2026-05-13T03:09:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "4404b9441856da0c79620d449b5fb17a0e640ea7",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                    "tekton.dev/pipelineRunUID": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "ba27645697e61920616382d5e6a2721d9dc0c723c810b3efdae8f2f2814755"
                },
                "name": "gl-multi-component-child-payf-on-pull-request-sqk7p-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-pull-request-sqk7p",
                        "uid": "2cbcb624-6fa8-4e11-aa11-d5aa729329cc"
                    }
                ],
                "resourceVersion": "93765",
                "uid": "85fe2191-0d51-41cb-bef7-0305c6f0d16e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa69091ed687d30eeaf758ec862ec28d86-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\", \"digests\": [\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\":\"sha256:480aaef99de7ebff3745cc4763c85be0395a0af81a36358a3c06453e4938bacf\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:09:46+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-278d045a37c56152566640318236986e-b2bc4f0831b0b900-01"
                },
                "startTime": "2026-05-13T03:09:30Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f46f90cee05feea6ba77ff91586296c4f2c1fb5c7c00f3cc69605a36ad1de19b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:38Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6b13473ee40118bda4c7a17fc406f75b288980ca13895f41fc388becb2e365bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8f4044c5ff46d113f7d60a54fa8bea0ca7093b15e65389811d1fe6cf4d0b34c8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:46Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7\\\", \\\"digests\\\": [\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75\\\":\\\"sha256:480aaef99de7ebff3745cc4763c85be0395a0af81a36358a3c06453e4938bacf\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:09:46+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:eb89435826f7c418b93f096cc0810f0380f898960c673dcc3613cef1d8a60e75"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:on-pr-4404b9441856da0c79620d449b5fb17a0e640ea7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/93707956-85a3-456b-b0bd-5c7c38b23272",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-a058ce7c6e93ff95-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:08Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "119426",
                "uid": "93707956-85a3-456b-b0bd-5c7c38b23272"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-f6qrc-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:9ddbd1910ad361e90e7e3a7d35209517f0fc2cda9b1e5fe5bc7933a377a7b81c"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-a058ce7c6e93ff95-01"
                },
                "startTime": "2026-05-13T03:13:08Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a870b412fc58e3ba2e91f77819677e63850a88dfa839a69fb434f7b35dcea8ef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b3ba00b72f7da45184a2b494e6511007024aaa8e29496bb48971e1e9af5a9660",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f0d808fe0cc957bc877ffc59ad2432eb56ae374baea2fc12f45fbb673f8b768a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:46Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1c990b7e7dba3e844b9c25260d5a32a3e89532d3b9808b80358f5e02451f24f2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:13Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6f9f6e014ef331a1b5e81e504c5f8d9c1364caad40b6bca3cf6e19ac413c1cee",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:36Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8aa4eb4cdc203fe6b1f9043727902eb98843e9a2761a3d4146d8d394547eb047",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:03Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:9ddbd1910ad361e90e7e3a7d35209517f0fc2cda9b1e5fe5bc7933a377a7b81c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-component-child-payf-on-push-f6qrc-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/97795336-b37d-44ba-bf54-f9ae1b9c7c55",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-0f31bdfb24d04550-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:04Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "120388",
                "uid": "97795336-b37d-44ba-bf54-f9ae1b9c7c55"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa9b33ed20ac8170d33c9c301e59837f90-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-0f31bdfb24d04550-01"
                },
                "startTime": "2026-05-13T03:17:04Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://05c049f5dbfffe8e3e8dc4b042b670a7630dd0cd57629eaa0272ebcb4bd7a166",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:12Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b15302966073c2ef54a6a4b3da7cadf01480ff1565f91616d263d385d3790725",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:13Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dfe4fd73792e4682fd63e2d6ce4e44862fa944ff604bbc9137cccf964fc37e5f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:15Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960@sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-component-child-payf-on-push-f6qrc-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/8d5c3f05-d6ba-4e96-813d-9aef1f0ba271",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-06767ffc6c6de0c4-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "121955",
                "uid": "8d5c3f05-d6ba-4e96-813d-9aef1f0ba271"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:18:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:18:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-f6qrc-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\", \"digests\": [\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642296\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-06767ffc6c6de0c4-01"
                },
                "startTime": "2026-05-13T03:17:16Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d48137b4db330becf5ac2c426039ccbd0f333606763e5f254d44b5c041511baa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:18:17Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\\\", \\\"digests\\\": [\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642296\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://948f94e2d864a86249f7125e1e400c0b85eb51a2bbeed68e672c56f231769cd6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:18:19Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\\\", \\\"digests\\\": [\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642296\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:18:17Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/2ff7ef00-25b8-479b-96ef-08585d6cb25f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-3ba34c29d64e144b-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:12:13Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "103378",
                "uid": "2ff7ef00-25b8-479b-96ef-08585d6cb25f"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-uroneu"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:12:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:12:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa69a5741b753f629f97fb6c6d7835fcb2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641903"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "6a16dd9"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-3ba34c29d64e144b-01"
                },
                "startTime": "2026-05-13T03:12:14Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b7c71776b818490afbb90e398dbcdace05bedc85675a8fb0b0be92914204a519",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:18Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641903\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"6a16dd9\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:18Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://30d3db0f026b2326da9c43c5c0e7cbd185bf167004267a47cfa6342cd05b2ab5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:19Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641903\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"6a16dd9\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4ea62d7bd4d026838cd0a4d61319bd9469dbbc117199c825f75d0e9d6bb01be6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:20Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987\",\"type\":1},{\"key\":\"commit\",\"value\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641903\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"6a16dd9\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/da620227-d187-48b4-bde2-44764378aebe",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-8a5d70502d1469d2-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "103000",
                "uid": "da620227-d187-48b4-bde2-44764378aebe"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:12:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:12:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-f6qrc-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-8a5d70502d1469d2-01"
                },
                "startTime": "2026-05-13T03:11:51Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8dd0d3d4035923725f1ba85fc5084041a068384c0b7f9765b836f2d1ab0c5fb5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:11Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/c775b79a-b23c-4ee7-bb0b-fddc89645dff",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-009e0d5da9f748eb-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "120878",
                "uid": "c775b79a-b23c-4ee7-bb0b-fddc89645dff"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa95e132ac7717e09dbf3567fe62785fe8-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\", \"digests\": [\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:17:29+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-009e0d5da9f748eb-01"
                },
                "startTime": "2026-05-13T03:17:16Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5d217d756dee9838d267b290d7af42ce748f137ed625f6a531172a4bdf8bb68a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:29Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f58c159c77562637a23102c94534f26e45c524bc03dc15eccbdb1a57d1dcdc8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:29Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\\\", \\\"digests\\\": [\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:29+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/9e1132af-b474-415c-b3da-d56d34d83e45",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-4cf3e877ca0a5f7d-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "121089",
                "uid": "9e1132af-b474-415c-b3da-d56d34d83e45"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa28317d8879de16a3125c9b58c5e77622-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:17:33+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-4cf3e877ca0a5f7d-01"
                },
                "startTime": "2026-05-13T03:17:16Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b569fd7deb364c6cb6a9d008cac7297df9c41aaee928eb32f01d027a49876515",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://71ed6c07be2b5bf224bbaf3e6b03fbf13c111d7c5d37981f7ead2c73b3c44023",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:33+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d349e4ea1b6ee7afc1708906340e711d9533a56493752d10e2f6cd33cd739781",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:33+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/db47eeea-d64e-4148-b811-f56505d7cb17",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-e0aedfe96f5320e2-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "120750",
                "uid": "db47eeea-d64e-4148-b811-f56505d7cb17"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa685214e230dcd57acf3452fdc2283918-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:17:23+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-e0aedfe96f5320e2-01"
                },
                "startTime": "2026-05-13T03:17:17Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c1ae5a8423db96c8833d4de8a4b65cd55eb600cc68f8fc6d3158896e3463500c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0eb2748ee41583fcc653d194ce3d1011b4b07d10c0e695896598551dcc8776e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:24Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:23+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b073393bb18acd4d84db80567f880d4cf312bc33984dedd6863c653ee8dd88b1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:23+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:24Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:04c0fa88f79076ff9ab1dd5479c3f57273cb9b3e6d4184f9137461c12d927987=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/commit_sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uroneu",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965692",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-f6qrc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630/records/c5b30d11-2dea-433f-8a81-76709665f151",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"6a16dd9464d49c649a8ebccf92adf42804ff0960\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/90aad932-4d29-441c-901f-7772d9df6630",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d77c9cf2cda2aeda34c8d47241ea6628-15c839fd388a1234-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:17:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "6a16dd9464d49c649a8ebccf92adf42804ff0960",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-f6qrc",
                    "tekton.dev/pipelineRunUID": "90aad932-4d29-441c-901f-7772d9df6630",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gl-multi-component-child-payf-on-push-f6qrc-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-f6qrc",
                        "uid": "90aad932-4d29-441c-901f-7772d9df6630"
                    }
                ],
                "resourceVersion": "121005",
                "uid": "c5b30d11-2dea-433f-8a81-76709665f151"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:17:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:17:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-f6qrc-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\", \"digests\": [\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\":\"sha256:f460626e2fb355b01c14f21caabeb2f3a6cb7e625a21d633021c0bc3392f0f67\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:17:32+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d77c9cf2cda2aeda34c8d47241ea6628-15c839fd388a1234-01"
                },
                "startTime": "2026-05-13T03:17:17Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3d82d2320199c184915c9c65e1c2ba22525b88755822cef922d8200140136c3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:24Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://29a0b11e50490e52a6f8ea9c6cf105335fcebe6afacd57c909cbb0cfa12e300d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:26Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3cc52279191d937e942a8bec7b312192798d3f9b5c6492aca35c37dbad097789",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:17:32Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960\\\", \\\"digests\\\": [\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e\\\":\\\"sha256:f460626e2fb355b01c14f21caabeb2f3a6cb7e625a21d633021c0bc3392f0f67\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:17:32+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:17:27Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:339cdd011a9239f2ede7cb660a674c52f3d52324731ddaf9f454fa87033d8f6e"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:6a16dd9464d49c649a8ebccf92adf42804ff0960"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/54dcd29b-0ad6-4d6a-98e3-4420408ec544",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-61c3b08dee833089-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:45Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "110303",
                "uid": "54dcd29b-0ad6-4d6a-98e3-4420408ec544"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-zg76x-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:cdd75456677f5c75e2c88b5db5605b03e2d8269329bca6140aae93154da91d9f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-61c3b08dee833089-01"
                },
                "startTime": "2026-05-13T03:11:45Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://04ac16232877ee6e96d8d8c386e4767396de54add09307a24eb45d2ff008232b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://46006c195b3e4e20f677296ee84c2d38b0420e413c70059a1177d37fef53738f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9989e7b6111c5f594ecf094145a7cc64252a3e026c5ca4d56174d7f8c930a7ee",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:56Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://46b1257d896b1fa77c41b0df55da3c252c71cf3c5cfac591680a222d050d1ec2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:18Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://648cac02fc66f7d79e40e8c26a1416e9df92bd60ab1c8d5ee28939262b0a3713",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:49Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:18Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e9e9091aed4dd387762e229921369d56f544834818de3cb8eab89d357c291a20",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:23Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:cdd75456677f5c75e2c88b5db5605b03e2d8269329bca6140aae93154da91d9f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-component-child-payf-on-push-zg76x-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/3c5f53fc-5151-4b5f-ab28-334596f7849e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-adcb0bdf0ebfa42c-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "111138",
                "uid": "3c5f53fc-5151-4b5f-ab28-334596f7849e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pac8a0154152e115748a0444664442cadf-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-adcb0bdf0ebfa42c-01"
                },
                "startTime": "2026-05-13T03:14:24Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b91d9c45c3a24156f735cf9bf85adae90369ffbd67e710f3cbbeb6e82be2db96",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:31Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://961cf844a90158a172b9664cdb678bd81c013656b71a1acf498c71f0187e5b0a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:32Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c542d5eec9f0e9b0843041267b08c8bcc1944c149d449562973db3115e41c03f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:34Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81@sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-component-child-payf-on-push-zg76x-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/fa3e5900-98c9-4110-83af-4d165e5992fe",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-9e4a8224b953d160-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "116980",
                "uid": "fa3e5900-98c9-4110-83af-4d165e5992fe"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-zg76x-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\", \"digests\": [\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642144\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-9e4a8224b953d160-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://08065328976ffe41b04adf4646c09be00e2f380d3a0bdb88f549d33159fa4b83",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:47Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\\\", \\\"digests\\\": [\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642144\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dc1a29226da9fa0323387eef1c3cd11b3f99449e05f7868e76d73bb354e1c8db",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:51Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\\\", \\\"digests\\\": [\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642144\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/b8992e2d-f216-44fc-982a-1a4c4852371c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-613e9ce5a2bb6485-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:10:51Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "99455",
                "uid": "b8992e2d-f216-44fc-982a-1a4c4852371c"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xqxzcx"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa79862460b037d883a4b3b0726964991b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641838"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "7de4911"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-613e9ce5a2bb6485-01"
                },
                "startTime": "2026-05-13T03:10:51Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6d98da199da0f78e693c62a37e2b1c718c8c081d5dd0c005d821973fa324ef79",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:57Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641838\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7de4911\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0ea5fa0d659d035877416906c234e287927ae3c4b257a41d101d3704bdbfd225",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:58Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641838\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7de4911\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ae3aad80836ff5c73e318487d41d8d0c37884350fdb59c2fca58eabcc10014c8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:59Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5\",\"type\":1},{\"key\":\"commit\",\"value\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641838\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"7de4911\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-child-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/d8849fa4-b418-4038-98b7-b12db56cb948",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-50b2072025446b34-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:10:45Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "99000",
                "uid": "d8849fa4-b418-4038-98b7-b12db56cb948"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:10:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:10:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-zg76x-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-50b2072025446b34-01"
                },
                "startTime": "2026-05-13T03:10:45Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://950298eec95618472a9d438e64dab3879c88dc5fd67c7dacc21d1666165b287c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:10:50Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:10:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/e729a8ef-82ca-4fda-9d27-1d55113e8ce0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-4c734040b04e6e47-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-rpms-signature-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "112047",
                "uid": "e729a8ef-82ca-4fda-9d27-1d55113e8ce0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-paecaddf99f1e6a99183f7da12fad49686-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\", \"digests\": [\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:52+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-4c734040b04e6e47-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7642a5e2fd2680717ec1a87767d4fef15867abf74c0a8d8efe1206b9c7a49d84",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://728fa9da5c2e8f4335c95e26f63fbebaac655dceeb3d222cf23ee0b9d4ef6fba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:54Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\\\", \\\"digests\\\": [\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:52+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:52Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/3909d17c-e459-4093-8322-d32c6bfb306f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-246f3232a17cc5bd-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "112697",
                "uid": "3909d17c-e459-4093-8322-d32c6bfb306f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa5ac69e0148884781dcdf9fb77a1adf67-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:04+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-246f3232a17cc5bd-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4d4e091ef13e9bf29b29babbd3e15d9cf3fbb31f0b9e56b63218c6a61273695f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://de99f7be001a40d7ecea834b082e45085f0372e27d05b89510d35d196e9add94",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:04+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3ca6111eacba04cb1a1b11e06a3088701f119d65e9f12871be8dde74e266824f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:08Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:04+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/d9011ff1-b03b-42f7-90b2-6b0e51c43aed",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-029b1c4715c9c628-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "111260",
                "uid": "d9011ff1-b03b-42f7-90b2-6b0e51c43aed"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:14:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:14:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-pa9c7085f9ddedad44e32cfb5e0adbcdf3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:14:42+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-029b1c4715c9c628-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e0c6056962b48c876b1cb2a711b49d2e5cd2ca6bf1461940dbfd28da703c66fa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:40Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://66e6cdfc69d750b437148ac6ec5e9e1def86e023f4a0c5b0b608d9bc70931e60",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:42+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4fad5320468923ab587499c5451fdf8d4accbc603f921f7cb12c6f6705af4b79",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:14:42+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf@sha256:21a2f04b828abba36bf01fe6e3a3f52e37c2272cc5943b5d4c34ecf7f78708f5=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/tree/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/commit_sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xqxzcx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520963643",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-child-payf-on-push-zg76x",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-child-payf' into 'multi-component-child-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy/-/commit/7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150890",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150890",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4/records/39133380-f7c1-4173-bd3e-86bbd202a6ee",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-atunsy\",\"commit\":\"7de4911d725997eb69f8d67abc46e62915ce9a81\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-a1ebb3efba0a16340c7f701238e855c5-35f7a6d83d9fc3d4-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:14:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-child-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-child-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-child-atunsy",
                    "pipelinesascode.tekton.dev/sha": "7de4911d725997eb69f8d67abc46e62915ce9a81",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRun": "gl-multi-component-child-payf-on-push-zg76x",
                    "tekton.dev/pipelineRunUID": "ddd6800e-3bf5-4474-9588-ac8014def4b4",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gl-multi-component-child-payf-on-push-zg76x-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-child-payf-on-push-zg76x",
                        "uid": "ddd6800e-3bf5-4474-9588-ac8014def4b4"
                    }
                ],
                "resourceVersion": "112437",
                "uid": "39133380-f7c1-4173-bd3e-86bbd202a6ee"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-child-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-child-payf-on-push-zg76x-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\", \"digests\": [\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\":\"sha256:3f19288f3f1d18f8a813be474672eeb8596287ebf23b2f6f17e2d7f7a60fa008\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":6,\"high\":46,\"medium\":104,\"low\":14,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:00+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-a1ebb3efba0a16340c7f701238e855c5-35f7a6d83d9fc3d4-01"
                },
                "startTime": "2026-05-13T03:14:35Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ecf8d99b149a2ad16dc86918601ebb04cccaf896acacebc4dec64a568d346644",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:59Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ebc64f1532a6b389f31c29d320e76528e1ce080b47c22fd28c6990e3643ff333",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://213d016bbda95b7ef15b20f0cd9d9eed77adaa818bc80aaa18c0ed24fc513f2b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:01Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81\\\", \\\"digests\\\": [\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a\\\":\\\"sha256:3f19288f3f1d18f8a813be474672eeb8596287ebf23b2f6f17e2d7f7a60fa008\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":6,\\\"high\\\":46,\\\"medium\\\":104,\\\"low\\\":14,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:00+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:c75080076df0933ae9395544339b6c6af35476c38869816dca1a3e898da5411a"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-child-payf:7de4911d725997eb69f8d67abc46e62915ce9a81"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/a91a9c02-bcd9-49b0-8072-2c8f96eab085",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-df3c3a9e2c75551a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-component-ec4f593f7d356a427ba775e71d1f41f3-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "91037",
                "uid": "a91a9c02-bcd9-49b0-8072-2c8f96eab085"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-ec4f593f600cadf7ac7370c041eb981caa2aa73c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\", \"digests\": [\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641744\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-df3c3a9e2c75551a-01"
                },
                "startTime": "2026-05-13T03:07:50Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://724fe0cf50a3522c0f57486fe582204e066f70d8f4c3ca5344fa21961b755cfe",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\\\", \\\"digests\\\": [\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://45ff3dc7f42a54aede1841745e987fd7eadbe75e661ec1195a1bdd1f69c1861e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:08Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\\\", \\\"digests\\\": [\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/5a15fe44-cf33-4ab3-9ad4-d4f618c5fd46",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-886adbc2cd088589-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T02:59:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "69529",
                "uid": "5a15fe44-cf33-4ab3-9ad4-d4f618c5fd46"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-payf-on-pull-request-gkzc9-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-886adbc2cd088589-01"
                },
                "startTime": "2026-05-13T02:59:43Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e0fd73253fe2dcf19c9a195abaed82083ab72e6ce0368e9dca9fac0c4da3cfb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:02Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/065526d2-2d67-4263-a3d4-9213bcbfe8b2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-fc7b1a03fb8fc7bf-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:07:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "88464",
                "uid": "065526d2-2d67-4263-a3d4-9213bcbfe8b2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-pdebb2018c28ae5890526707e8fdc16e9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\", \"digests\": [\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\":\"sha256:cc1f80650c92c13b709dafa2b84955cf4774a3c32184267f7cbfdc5a71adafbb\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:22+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-fc7b1a03fb8fc7bf-01"
                },
                "startTime": "2026-05-13T03:07:51Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e761f3d985b4d5bac5d0ad9adc1384ac0e31fb2f2e6f89af8ac59eff751a0883",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://492104ffd4b0b946be11cf6d7850a1409e1e8b09a500de4cafdbc782518c0250",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://73ae82307b99472826ce2bbfd057c3a62b8c8cc1e29d8ae22b863d4e9a03f093",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:23Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589\\\", \\\"digests\\\": [\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af\\\":\\\"sha256:cc1f80650c92c13b709dafa2b84955cf4774a3c32184267f7cbfdc5a71adafbb\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:22+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:6828338a02dd2d45b5b810450ee075f9fc03cba34cc8243d28bb1026afc326af"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/2a87a2c0-d376-4045-8010-496d03c7d953",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-6f8f25a32d6bf678-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:13:04Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-build-container",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "115454",
                "uid": "2a87a2c0-d376-4045-8010-496d03c7d953"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-pf52087677f94fa2145a169e00e31a0b1-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:1ceda3438c0c48c160f4131f5887a97e1885b3dfe5f9349a1c84dfab208f5cc7"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-6f8f25a32d6bf678-01"
                },
                "startTime": "2026-05-13T03:13:04Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://98188c9b3fba5ab8d1b2f7de0fbbf73c51de2fd5f6bfcbd3bbdb61787c7ada76",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6e1f1913914a82248b1ea50917ea07091e75302f77d4ef7d553d54e70be1306f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:13:31Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3289f2d61f7d36f525744b6392f235e77958c1d1a156838a828538f19962bcfa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:13:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://73b45212d1254b7441b9c5e603d7cbfb809a7547103ebc627aaf43e68f8bbc49",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:14:36Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://72753939d2b657137baa8619ebb722731fee8b08dafc9180d7ef830634357bfa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:00Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:14:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d88ecc4ea578279aac7d566b51c65c90accbd1ee704624211c4d2926565996a1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:30Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:1ceda3438c0c48c160f4131f5887a97e1885b3dfe5f9349a1c84dfab208f5cc7\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "gl-multi-component-parent-payf-on-push-gwznw-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/3e4b6a06-8665-4155-8d3f-a6da50629eba",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-9fa3e9f566f0388a-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-build-image-index",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "116590",
                "uid": "3e4b6a06-8665-4155-8d3f-a6da50629eba"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-p8a57b4f1dfbc823ff7741ac96572899c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-9fa3e9f566f0388a-01"
                },
                "startTime": "2026-05-13T03:15:31Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://481ed156537162a0c3b8b7098cc311b77a6b6d214be56601ca0c66485d284156",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://22a9a3a9aca7f0dd4d4fe9b2265258af9e191ec9f665f300f36e8ca0ffc8c744",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:40Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1fe4d053769e0a9441191b8a829424be322fbe95ffd5e90ad4445c09b34ee9a8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:42Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2@sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"gl-multi-component-parent-payf-on-push-gwznw-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/10cc0c98-ff8c-4222-9fea-50a0e0e6b4b2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-cb389dca3857ab5a-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-clamav-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "118957",
                "uid": "10cc0c98-ff8c-4222-9fea-50a0e0e6b4b2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:16:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:16:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-payf-on-push-gwznw-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "589e34f73d310aa993c9761d8b78265a904a121028bda2809d8a2d0500454bd8"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\", \"digests\": [\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778642207\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-cb389dca3857ab5a-01"
                },
                "startTime": "2026-05-13T03:15:43Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9720830c806a1753985779e1c1d11c92e4ce07100c635dfd6cefcd46d686da7f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:47Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\\\", \\\"digests\\\": [\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642207\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7310b708177fc12175212aea793afee6481bb93eb179d67930d098172bee2319",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:50Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\\\", \\\"digests\\\": [\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778642207\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/6643846b-18e9-4458-8dc5-7f9bf721b0d9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-1aecaf7d9c02e8a2-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:57Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-clone-repository",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "103259",
                "uid": "6643846b-18e9-4458-8dc5-7f9bf721b0d9"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "revision",
                        "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xhzqjx"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:12:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:12:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-p53d67d1f6e5908b247be892e39c221ba-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641905"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "f1870a8"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-1aecaf7d9c02e8a2-01"
                },
                "startTime": "2026-05-13T03:11:57Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://78b0fd480ddc20feca0e712609bd5d40b261fcc7d1a4a05bb3dc847b92205e2f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:15Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641905\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f1870a8\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd0f19bf0f6b694003a35b861182e3a82d36069c17d264fd02ef1de7bd0b0837",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:15Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"commit\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641905\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f1870a8\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://afbf88d6927d779dc278febba1aabaf9bdafb6e70b595a56e46f71f0938d3c9e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:12:17Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0\",\"type\":1},{\"key\":\"commit\",\"value\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641905\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f1870a8\",\"type\":1},{\"key\":\"url\",\"value\":\"https://gitlab.com/konflux-qe/build-nudge-parent-atunsy\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:12:15Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/af7f0961-2f1c-4adf-b609-f696fc6435eb",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-95d7eb3abadcac08-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:11:53Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-init",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "102515",
                "uid": "af7f0961-2f1c-4adf-b609-f696fc6435eb"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-payf-on-push-gwznw-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-95d7eb3abadcac08-01"
                },
                "startTime": "2026-05-13T03:11:54Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a8fe181d0eaf2572a4d49e77cdde1b6fd2a5c013176eb4535a48b8be6eb4807",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:56Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:56Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/058785ad-9b48-4787-b3dd-a5a906508614",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-3e381f3698869379-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-sast-shell-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "118079",
                "uid": "058785ad-9b48-4787-b3dd-a5a906508614"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:16:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:16:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-p017849c5810372546e2be1e39c6be263-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ecfae10944b45b91988ddc6311c7232bf2c98ba73c5fc6261861ecfd33434db0"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:16:20+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-3e381f3698869379-01"
                },
                "startTime": "2026-05-13T03:15:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c777b29a0484742de76260445affd1c05718fd0591f68b3031ab11da4eb8c113",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:10Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://429bf2b4d7cf9234191427ecd84eeed35b368028bd4710fab4186aac8f79b31d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:16:20+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1a4992ec054b32dd68abf96eda1f272fd5707520a8640f7eb1f4fa09bea124e3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:21Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:16:20+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/189f7ab7-2e14-42c6-99d6-eee5de12c272",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-829f9cbd14f621f0-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-sast-unicode-check",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "117760",
                "uid": "189f7ab7-2e14-42c6-99d6-eee5de12c272"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:16:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:16:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-p4135567342ab2747f5b1e58d911e8ce7-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "96badf0b06d83fc1e7cf50048f94091e257819ee537f063830541f9c97295200"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:16:12+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-829f9cbd14f621f0-01"
                },
                "startTime": "2026-05-13T03:15:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://889e6a124d6af96de1c949a35a195f9a752eccfc0fd6d9b4c0a9225d4ac8980d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:11Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ae9abf1f9397c7c5c3fc7abc13915d796a0b22b31dcadab5f0ec56771830a6f2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:16:12+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://21cb0c5ecfc2c389ccb83b88f612edb715bb105a4e6771becb87711d4190d15d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:16:14Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:16:12+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:16:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:9566c1d752db532d5bc2c8a98bd9eac628ec9d50ea2af0037aa74991d8c5c8f0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/commit_sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xhzqjx",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520965728",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-push-gwznw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-multi-component-parent-payf' into 'multi-component-parent-base-payf'",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03/records/07b59eea-8ed4-492b-ab32-f34eb577dbc8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"f1870a8aca89079ae5989d04061d90e9a287d9b2\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/64443e5c-2a96-4116-b174-c043e5990e03",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-c9e8f4ae370e3f6f6f0cf112157780ce-69607e747937cc70-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:15:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-post-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-push",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-push-gwznw",
                    "tekton.dev/pipelineRunUID": "64443e5c-2a96-4116-b174-c043e5990e03",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "gl-multi-component-parent-payf-on-push-gwznw-tpa-scan",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-push-gwznw",
                        "uid": "64443e5c-2a96-4116-b174-c043e5990e03"
                    }
                ],
                "resourceVersion": "117222",
                "uid": "07b59eea-8ed4-492b-ab32-f34eb577dbc8"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:15:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:15:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-component-parent-payf-on-push-gwznw-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "68b6e188f742da92af9c40a794fd021a65d49b419d1e36096277b2d9ebbe1afc"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\", \"digests\": [\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\":\"sha256:72edb547a2535bfe2ae6084029cb7aaeee608b11fdd96ea95c62fce04a3989d5\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":4,\"high\":28,\"medium\":53,\"low\":9,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:15:57+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-c9e8f4ae370e3f6f6f0cf112157780ce-69607e747937cc70-01"
                },
                "startTime": "2026-05-13T03:15:44Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2b3d65e9c85259a70efa4048830c3914164d3a670bca78ed1ee966ea624c28bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4fd1d702424ba4e8ef690680a4789fc65dde2ff6a4c4d77a54081063c5f099c7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://02e10fc2cc325d5e65be71e79954ce3547f09fe394e8ac775a43fc7375cdc862",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:15:57Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2\\\", \\\"digests\\\": [\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21\\\":\\\"sha256:72edb547a2535bfe2ae6084029cb7aaeee608b11fdd96ea95c62fce04a3989d5\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":4,\\\"high\\\":28,\\\"medium\\\":53,\\\"low\\\":9,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:15:57+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:15:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:fcc68d96a9a10d2721c17215f1d7040c9f6f7a63c4f7f50bd3af602ccb246d21"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.5.0@sha256:200019314a50be5b6dd06f362c794c92a700583a522c5eee9a41e3eab7f706c5",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/tree/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/commit_sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-payf",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-payf",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "Merge Request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wyxccw",
                    "pipelinesascode.tekton.dev/git-provider": "gitlab",
                    "pipelinesascode.tekton.dev/gitlab-pipeline-id": "2520944317",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/build-e2e-vnes/tekton.dev~v1~PipelineRun/gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-parent-base-payf\"",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy/-/commit/2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-gl-multi-component-parent-payf",
                    "pipelinesascode.tekton.dev/source-project-id": "82150879",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/target-project-id": "82150879",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207/records/9d90d16d-6859-4de8-8eb2-8cf33f698d44",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-atunsy\",\"commit\":\"2ffbfd56594328dd93278dd14cbbd2236d777589\",\"eventType\":\"Merge Request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-vnes/results/6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-0f98f7fa0d9cda614fc918cfb4ec5d53-6fe60418bf224388-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-gl-multi-component-parent-payf"
                },
                "creationTimestamp": "2026-05-13T03:01:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-btzn",
                    "appstudio.openshift.io/component": "gl-multi-component-parent-payf",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "Merge_Request",
                    "pipelinesascode.tekton.dev/original-prname": "gl-multi-component-parent-payf-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.build-nudge-parent-atunsy",
                    "pipelinesascode.tekton.dev/sha": "2ffbfd56594328dd93278dd14cbbd2236d777589",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRun": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                    "tekton.dev/pipelineRunUID": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "d5c2369fdaca1ff4a4231166634ce20dfe2323d6c8e53c1f8f787ceab3cc79"
                },
                "name": "gl-multi-ec4f593f7d356a427ba775e71d1f41f3-prefetch-dependencies",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "gl-multi-component-parent-payf-on-pull-request-gkzc9",
                        "uid": "6fd6bf1a-5f33-4439-8ac1-7c849b0da207"
                    }
                ],
                "resourceVersion": "73970",
                "uid": "9d90d16d-6859-4de8-8eb2-8cf33f698d44"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wyxccw"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:02:40Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:02:40Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "gl-multi-ec4f593f7d356a427b937de33123af6c3ed67101e5fda75ebf-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-0f98f7fa0d9cda614fc918cfb4ec5d53-6fe60418bf224388-01"
                },
                "startTime": "2026-05-13T03:01:44Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://258fa72b32c8045c66e2012b5f97b256ec25ee99ea08761fd02ebe400d99b267",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:56Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://eb42785d79be62b0ccb843fb1bbca03a6271f1354985aafc6704d31748729ed7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:56Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://626adeeb3542bf0ab1af97fb69dc9b07987370f07b78e23f50257e3809abe10c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:39Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f0406d6c2870dec6dc095d01b0243aed4c49c6e29edc226f2652c30807879da9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:40Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf@sha256:3ea5795d4deda7b0678b0924bc449b894251709758cd387b2cdc2803cc9b9d28=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:on-pr-2ffbfd56594328dd93278dd14cbbd2236d777589.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "gl-multi-component-child-payf",
                    "build.appstudio.redhat.com/nudging-commit": "f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/nudging-component": "gl-multi-component-parent-payf",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-vnes/gl-multi-component-parent-payf:f1870a8aca89079ae5989d04061d90e9a287d9b2",
                    "build.appstudio.redhat.com/nudging-pipeline": "gl-multi-component-parent-payf-on-push-gwznw",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-vnes/results/f4b8da5d-e612-4f81-8957-a3858ad2e80f/records/7d74be38-af87-465f-81a9-69cafa3b81dd",
                    "results.tekton.dev/result": "build-e2e-vnes/results/f4b8da5d-e612-4f81-8957-a3858ad2e80f",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-e3a245a84435e697cd76e7604962f678-4a6312a51a0beedb-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:16:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1778642210-8fe8b",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1778642210-8fe8b",
                    "tekton.dev/pipelineRunUID": "f4b8da5d-e612-4f81-8957-a3858ad2e80f",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1778642210-8fe8b-renovate",
                "namespace": "build-e2e-vnes",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1778642210-8fe8b",
                        "uid": "f4b8da5d-e612-4f81-8957-a3858ad2e80f"
                    }
                ],
                "resourceVersion": "123387",
                "uid": "7d74be38-af87-465f-81a9-69cafa3b81dd"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-gl-multi-component-parent-payf",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_490b26263c RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-payf-57d45.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_vnes_gl_multi_component_parent_payf_a5939966a2','password':'${TOKEN_6b1a2be449}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642210-8fe8b"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642210-8fe8b"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642210-8fe8b"
                            },
                            "name": "renovate-pipeline-1778642210-8fe8b"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642210-8fe8b"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-13T03:19:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:19:14Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-pipeline-1778642210-8fe8b-renovate\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:29a2f31\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1778642210-8fe8b-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-e3a245a84435e697cd76e7604962f678-4a6312a51a0beedb-01"
                },
                "startTime": "2026-05-13T03:16:51Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:19:14Z",
                            "message": "Step renovate terminated as pod renovate-pipeline-1778642210-8fe8b-renovate-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T03:16:50Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_490b26263c RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-payf-57d45.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_vnes_gl_multi_component_parent_payf_a5939966a2','password':'${TOKEN_6b1a2be449}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1778642210-8fe8b"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1778642210-8fe8b"
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1778642210-8fe8b"
                            },
                            "name": "renovate-pipeline-1778642210-8fe8b"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "renovate-ca-1778642210-8fe8b"
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/8f96ed89-21f7-4f76-ad8e-4498347e4488",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-c8c0fa0d69b303e2-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:01:06Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags"
                },
                "name": "buildah-demo-xqbvpimkbm-apply-tags",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "70268",
                "uid": "8f96ed89-21f7-4f76-ad8e-4498347e4488"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-c8c0fa0d69b303e2-01"
                },
                "startTime": "2026-05-13T03:01:07Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df545f408dede3383556352679badc5267c8838c86eea6bb52c95d45febf5bcf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm",
                                "--digest",
                                "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-c8b89a7b86",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/4b1b25fc-bc21-4aa7-b268-2da7c8730086",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-db5ed163e22150c2-01\"}"
                },
                "creationTimestamp": "2026-05-13T02:58:14Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.9.3",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah"
                },
                "name": "buildah-demo-xqbvpimkbm-build-container",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "67915",
                "uid": "4b1b25fc-bc21-4aa7-b268-2da7c8730086"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Containerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.9@sha256:62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:00:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:00:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "62f09c50d552eac57e17638c67e88b0982352a71975858c8ba262bcff293de06"
                        },
                        "entryPoint": "buildah",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:49ec47bc76d70a7c8eb8d95016bb477c53027bbd582d6956bd6e76321b5b28b4"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-db5ed163e22150c2-01"
                },
                "startTime": "2026-05-13T02:58:14Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7aef9e7e57326e5c4218fa930923be1c2184eda08511ae5999309f66e28e8775",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:59:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e2d0891d7b5c0602d9a5b0c324f5c71a1d0b1f45037e85aafc440b8ca445a17",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:59:35Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:59:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3aa3497047b3a6afdc6f0087c5b6a511b790da7a8c16971db32c664662e768f5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:59:38Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:59:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e76d93ca70da9dd3a730a1a39acf80723af57d00042ed0ccf99ee24c7da0f4ae",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:59:54Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:59:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fd8a711c97aa8dc39aed5a8c4945139436f36b0bd14401ce26427331e59ff190",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:00:20Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:49ec47bc76d70a7c8eb8d95016bb477c53027bbd582d6956bd6e76321b5b28b4\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:59:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/conforma/golden-container.git"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Containerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "buildah-demo-xqbvpimkbm-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/36f13f2d-b6dd-4c05-8ef5-94954e45a0c9",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-aedc5f4a31a6dcac-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:00:21Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index"
                },
                "name": "buildah-demo-xqbvpimkbm-build-image-index",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "69886",
                "uid": "36f13f2d-b6dd-4c05-8ef5-94954e45a0c9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:04Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:04Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-aedc5f4a31a6dcac-01"
                },
                "startTime": "2026-05-13T03:00:22Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5e2ef8324eae85bb7fcdef5a8be3459f7f72cf4ba43f83107c7672d254d726c7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:00Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b67d6fc8bc44f083014e1138e53bb4ceb4681e10c9494fe5fde32e4edcccc0f8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:01Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e78a57d37eddc8a843a8b282a63a63b4841d92166fc9aceaeda03d03d3f8841d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:03Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"buildah-demo-xqbvpimkbm-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-c8b89a7b86",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/85416dce-05e8-476c-b3a1-383b557c88b1",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-525dcfb4f9f81553-01\"}"
                },
                "creationTimestamp": "2026-05-13T02:57:29Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone"
                },
                "name": "buildah-demo-xqbvpimkbm-clone-repository",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "57378",
                "uid": "85416dce-05e8-476c-b3a1-383b557c88b1"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "revision",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:57:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:57:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/conforma/golden-container.git"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "be3214825d8af1a44d1406df6233660e8372d26f"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1775533888"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "be32148"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/conforma/golden-container.git"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-525dcfb4f9f81553-01"
                },
                "startTime": "2026-05-13T02:57:29Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9ccd25bcb5d923f0eca9969ccdce81aa7ed649cad24d070e9c9d7263a8ceca4d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:57:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:57:44Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e254893752db52e0034c09c81479f595c705f64095ddd585b3d772a0a8d7b27",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:57:45Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"be3214825d8af1a44d1406df6233660e8372d26f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1775533888\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"be32148\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:57:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/conforma/golden-container.git"
                                },
                                {
                                    "name": "PARAM_REVISION"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/c2f1897b-5264-49dc-a804-6128e692244c",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-b98a83de7eea3614-01\"}"
                },
                "creationTimestamp": "2026-05-13T02:57:13Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.4.2",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "buildah-demo-xqbvpimkbm-init",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "55229",
                "uid": "c2f1897b-5264-49dc-a804-6128e692244c"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:57:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:57:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-b98a83de7eea3614-01"
                },
                "startTime": "2026-05-13T02:57:13Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13b9e0172c339503c6e1014221011081d54d10d3ffdc865bb32556dbd17450be",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:57:27Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:57:27Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-c8b89a7b86",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/bcb20cdd-5ace-4bcf-a011-f00707c5f697",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-ff50fc26f7664a30-01\"}"
                },
                "creationTimestamp": "2026-05-13T02:57:47Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3.2",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies"
                },
                "name": "buildah-demo-xqbvpimkbm-prefetch-dependencies",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "60099",
                "uid": "bcb20cdd-5ace-4bcf-a011-f00707c5f697"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:58:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:58:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-prefetch-dependencies-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-ff50fc26f7664a30-01"
                },
                "startTime": "2026-05-13T02:57:47Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8ccd469cf2ba123a87b3f4ed9976065e7166c782d0a2370d954def0bb0a41adc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:58:13Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:09Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-c8b89a7b86",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3/records/257dcf3d-f9e3-4861-b36e-db8585ebc54d",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-4b6b6782642b90407465dd68de0c23d7-85ba65c34821be20-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:01:07Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.3.1",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.openshift.io/runtime": "generic",
                    "pipelines.openshift.io/strategy": "docker",
                    "pipelines.openshift.io/used-by": "build-cloud",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "docker-build",
                    "tekton.dev/pipelineRun": "buildah-demo-xqbvpimkbm",
                    "tekton.dev/pipelineRunUID": "0150405e-6381-45a1-9cd0-cca7d2bed6d3",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile"
                },
                "name": "buildah-demo-xqbvpimkbm-push-dockerfile",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "buildah-demo-xqbvpimkbm",
                        "uid": "0150405e-6381-45a1-9cd0-cca7d2bed6d3"
                    }
                ],
                "resourceVersion": "71268",
                "uid": "257dcf3d-f9e3-4861-b36e-db8585ebc54d"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Containerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "app-studio-default-workspace"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:01:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:01:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "buildah-demo-xqbvpimkbm-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/test-images@sha256:cb07ed81e3dccb1a7415be7ce5053924380594d69a87f208431ee82ae32e8a10"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-4b6b6782642b90407465dd68de0c23d7-85ba65c34821be20-01"
                },
                "startTime": "2026-05-13T03:01:07Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://091c08bd1a5158bfab61025c2b9274633eb63b8b23895f7f200dc4dfa5b13b42",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:48Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:cb07ed81e3dccb1a7415be7ce5053924380594d69a87f208431ee82ae32e8a10\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                ".",
                                "--containerfile",
                                "Containerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm",
                                "--image-digest",
                                "sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/d9ea337a-a7ca-4078-9f52-376cf5a23861/records/ee9cb15d-0034-47e9-a042-a7686cda0c47",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/d9ea337a-a7ca-4078-9f52-376cf5a23861",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-aaa6221c330053427c69294dcad5591b-0183ed7d6524962f-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:08:14Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-2h84n",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-2h84n",
                    "tekton.dev/pipelineRunUID": "d9ea337a-a7ca-4078-9f52-376cf5a23861",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-2h84n-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-2h84n",
                        "uid": "d9ea337a-a7ca-4078-9f52-376cf5a23861"
                    }
                ],
                "resourceVersion": "89053",
                "uid": "ee9cb15d-0034-47e9-a042-a7686cda0c47"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/golden-image-public-keygjllxhympo"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-1f1bb03d4c2403fc38ea9c41d351eb66-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641711\",\"namespace\":\"\",\"successes\":84,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-aaa6221c330053427c69294dcad5591b-0183ed7d6524962f-01"
                },
                "startTime": "2026-05-13T03:08:15Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c5866324933341b5d21d8870d20e894a7d09eb0aa75c5d7e74c84ef0520a9c0b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:20Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2308c13bd73982303c91aa68998338665c635141b00f9dddd064656092184de2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef93ce39d326d07e2bbcca6be75da2caee25f3e43635c58ba1e4e7c719e03e16",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:31Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:21Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d9beaf61108eb47cfed7cbaa4051338efe4a719485ef8c8c65fd89e13ca29b67",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e748e3613ed3874957eeb49a393207cf8fc5ede9f45de228b1d9f0b620099500",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7b62dcfd97512870872dd897103ebd205e4b630085fbf103d0579c6d725aa946",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f82fe611c77c7315eee3018fe22a3eca8674413a38f29f4bf732f4b75c6e3b47",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d9e1a8caee7bba3b74afb022292eefa43667cf2756659f0f9964bc17a3feb1f9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7b6a09691f42d9d3392f6ff40e7de157eb9afc925a247478583e036027e7f93e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641711\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/golden-image-public-keygjllxhympo"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/58949d55-092c-410a-836e-d399913cd80e/records/f7563d5c-0d1d-4357-9bea-aa56225e6189",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/58949d55-092c-410a-836e-d399913cd80e",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-332d48ae1983636558001d7e17309c11-c0a269c087ffd6ce-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:07:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-2w8wp",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-2w8wp",
                    "tekton.dev/pipelineRunUID": "58949d55-092c-410a-836e-d399913cd80e",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-2w8wp-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-2w8wp",
                        "uid": "58949d55-092c-410a-836e-d399913cd80e"
                    }
                ],
                "resourceVersion": "87062",
                "uid": "f7563d5c-0d1d-4357-9bea-aa56225e6189"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/dummy-public-key-jbelghccst"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:00Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "StepFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-e87415ba112038530c4d75fa24164909-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641677\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-332d48ae1983636558001d7e17309c11-c0a269c087ffd6ce-01"
                },
                "startTime": "2026-05-13T03:07:36Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e76061ac3c2690e0dfee0ef27659c04bb9e7907743060f887b646ecaf6bf98ad",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:53Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7289c60f84133eb7a4ecab329513c3c085bb3ec195f98a8ddfe444e2fbd10e3b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://daae5939a0b5ccd367faa44a76f64f3a0ad9be8e708f5274f01f133056bc9122",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://83edc07d6998cd3efc13d005609a28fd6620b1bcdac22c510291fefc2328d505",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d5b437627bac69168a3d5b2d3cf73a286b36f3027f0944958b81652fcf10f50a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://99d72e2df580b9ff715b3bea4eaa0174b93bc404613fa9cf6776b0ecd0cce62f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6c74f50232f64bcc7bb5669e6fe317003921466d7a1f5119fbaeff4e80b59f9c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5986047c379f62257eb6c2be012df8f70f00ae3654be2808510012e4efb64bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://29b0f4a74a2c182f78a55a67b001e2d2c59261a8b7c3c0e28ba6113c948b868d",
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:08:00Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641677\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-13T03:07:59Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/dummy-public-key-jbelghccst"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/be93c636-7c6b-4f3c-af86-350f2901025d/records/11493281-3e82-4056-b9c5-ee52a426c671",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/be93c636-7c6b-4f3c-af86-350f2901025d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-72adfce21a143f69795997ed2c5383df-7b30d1715a573b69-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:08:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-6bkc6",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-6bkc6",
                    "tekton.dev/pipelineRunUID": "be93c636-7c6b-4f3c-af86-350f2901025d",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-6bkc6-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-6bkc6",
                        "uid": "be93c636-7c6b-4f3c-af86-350f2901025d"
                    }
                ],
                "resourceVersion": "90850",
                "uid": "11493281-3e82-4056-b9c5-ee52a426c671"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/golden-image-public-keyfitdznekuh"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-d47bc83022ce45ade4fed790060f4015-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641744\",\"namespace\":\"\",\"successes\":393,\"failures\":0,\"warnings\":42,\"result\":\"WARNING\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-72adfce21a143f69795997ed2c5383df-7b30d1715a573b69-01"
                },
                "startTime": "2026-05-13T03:08:35Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e317963d44f99aa457855aa61b8fb425c53f6f563c7704682fb492bb6ca043ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:41Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5357e7937f800ca6fd6cee8edc1d2cc0368b4d3d5a84b01209dad24d00c1f0f1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dad01168c1e1badb60ae676d4ec0349237e09a06723f7c1e978da558bc9a2953",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://895961d07eb8e0f1bf24171e94a2fcb5ce6322cdadb97ebed1cdfdc5e5a75c8a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c67e4eb9680a239f30ac152d1211a4127fa2574d86657a27471d06b76e1e7c50",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91629f5809860163236226e3a80dda2e06a0f3c967601ee5f0ef722743651350",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://067bf038a0fb78fd14a877cd2c0f28f49ba12600a7977cbdbda2d314a8c589f1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://eab19da8745c90d94f7f880017dad054cef9d9032f8a69c0705b2aa2717a3268",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:04Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c7840ebdde2370753cd00cb545143968138a5bc60ba885fb05eb3581c2abada7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:05Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641744\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":393,\\\"failures\\\":0,\\\"warnings\\\":42,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/golden-image-public-keyfitdznekuh"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/fd287b18-063b-4b94-aed5-b0c2573ffacc/records/12969672-cc6e-42a4-9a5c-982b34b5f548",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/fd287b18-063b-4b94-aed5-b0c2573ffacc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d49e7bf81535b31d665c0b13e1a863ee-c207f12384a4bf12-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:07:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-h9v4l",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-h9v4l",
                    "tekton.dev/pipelineRunUID": "fd287b18-063b-4b94-aed5-b0c2573ffacc",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-h9v4l-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-h9v4l",
                        "uid": "fd287b18-063b-4b94-aed5-b0c2573ffacc"
                    }
                ],
                "resourceVersion": "85455",
                "uid": "12969672-cc6e-42a4-9a5c-982b34b5f548"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:34Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "StepFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-43b4f74b9aece9c0875eb04634e50cf0-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641652\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-d49e7bf81535b31d665c0b13e1a863ee-c207f12384a4bf12-01"
                },
                "startTime": "2026-05-13T03:07:17Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3e5ccf5f6ad324bc1e12008b4a974180140750b3aa8c285a88cf572bb15b6c1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:25Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:25Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bde991bf3f23044adc5cce2dd564a317123d3f2350d3ad5ba139c14075525384",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:26Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dafbb941b56e0308aa55a10164d8785a5271809c69e23c94fbe38f5554c013e4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:32Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8ee256421ea4f2f1af165bb6f7575d195e4262356aa097198ae50aefe61a1a47",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7eb11a94f827affefb2091bcd4b78173866ec6af5fd1867a085b7a67377a6ec4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a0a384d1b827950933b1dea8f292f0e28226d51c1b6dcdacac6f221c46e135e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://84601833fa3948c9089d432b741f740d8e2e97cfba8bae3ee71bfeb148dd5bbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://57d65686dc499aed372a3d4923a39250aa2c94ec3ec5befc3b6f3d71857610d5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1b0f1fd833279b1b6ee7012a4f9f9e6ca12a33d7384d745b5bf6d8ce59aa4e3a",
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641652\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/008e15d4-8495-43d4-8258-72ab47d405de/records/70534c6b-43f8-45e1-8dea-ac14cc96871c",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/008e15d4-8495-43d4-8258-72ab47d405de",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-3a7ae722086f39768b6967bac0234beb-ffb5dc2911783d6a-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:08:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-km5h6",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-km5h6",
                    "tekton.dev/pipelineRunUID": "008e15d4-8495-43d4-8258-72ab47d405de",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-km5h6-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-km5h6",
                        "uid": "008e15d4-8495-43d4-8258-72ab47d405de"
                    }
                ],
                "resourceVersion": "87918",
                "uid": "70534c6b-43f8-45e1-8dea-ac14cc96871c"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:13Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "StepFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-5807d8a9ee79cae658fee20e3132acdf-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641692\",\"namespace\":\"\",\"successes\":0,\"failures\":6,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-3a7ae722086f39768b6967bac0234beb-ffb5dc2911783d6a-01"
                },
                "startTime": "2026-05-13T03:08:01Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8c67a3da48c60193b80896067377cc6231e56bae19d1e383fdb1e2c047e7c89a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:06Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c471ce9bb4081cded5929c13589b27d625467eeb93d450898bc5b022de5b7cd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5984a4f9f8ef7a0f09d226bcc6bf7de262065cf6ecb1565256a3e4b6761cebbc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0ab3fec2017a7c856097a94a75c8c08894a6c6d4bc5e385c1eb5d93dc2bed263",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a48a4f4cab51af34db4528ce26f2d659d738cd43cac27a4adaa6fad4f76557ac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cdad033414de191d02bd4b9ddbbf1790ae4d29ef57f5f53645d2f6e72a6a1f99",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f16598a59e3b2442081e67f62b7abf2506ce492641345de78c610b154191f9f2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1cb1188ae343912ac829a2b9dd824aa943ef912b91883875237a9b5f29067c8c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c641de22ba5157928e75f4b756df3762c4b6c0fbafd1d48cbaaa44fdf1980674",
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:08:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641692\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-13T03:08:13Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/30b7a1e4-dc16-4a16-aa5c-f8f7fe0b4001/records/3ca3e33b-34cb-473c-9ff3-4784e07525a0",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/30b7a1e4-dc16-4a16-aa5c-f8f7fe0b4001",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-050917c966d2f6f1f5fdca0508a80a75-a6c32f802c42701a-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:06:18Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-lnr9p",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-lnr9p",
                    "tekton.dev/pipelineRunUID": "30b7a1e4-dc16-4a16-aa5c-f8f7fe0b4001",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-lnr9p-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-lnr9p",
                        "uid": "30b7a1e4-dc16-4a16-aa5c-f8f7fe0b4001"
                    }
                ],
                "resourceVersion": "83931",
                "uid": "3ca3e33b-34cb-473c-9ff3-4784e07525a0"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "false"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-96fbf0b5d69cbb4dfd874b759755a476-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641633\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-050917c966d2f6f1f5fdca0508a80a75-a6c32f802c42701a-01"
                },
                "startTime": "2026-05-13T03:06:18Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95dfb774d59a64b526b47d867cbf8062493243b888ea1e26b3c290d0860042ff",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:07Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6438143f732b1b696775daab21920c5c12e0aec09a253e2f0c4eb1d487a33734",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e159ced10a0544131ea200e1e53b7c618006c14baa898f1880453f49bef85514",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0e8be7d9ce78a5b9e924f8116e5368bc76f8ed3271f55e931dfd45c915e09bf9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b3910a59e1b98c1d49ef3023eb323e394fc9b41da31b227e68c1bf995018353",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0f340a924f938adddc1039e0d37b062a2569e6c816f335b74180249d123d8a78",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b02dc8a49ac872bd18f92547a2e83df1fed21599981424a4c7950ad4762c96a7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d2e1654ffac5a8d9bfd18a5a64fa512264bb5d092cf6359b3653019aac08c578",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea0b2e9e0876251a88c56552a58f8bd37699125fc6e21860c1b05ead85161d43",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:14Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641633\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:14Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "false",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/c98a8907-365c-4aa5-b795-872b76f981d1/records/5731c2ab-140b-4728-8317-ce11b6212bd2",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/c98a8907-365c-4aa5-b795-872b76f981d1",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-91b4aa5d289f1f9e5550b0f93f489196-b6a2eb3d7aaeb276-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:09:06Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-n2z4f",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-n2z4f",
                    "tekton.dev/pipelineRunUID": "c98a8907-365c-4aa5-b795-872b76f981d1",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-n2z4f-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-n2z4f",
                        "uid": "c98a8907-365c-4aa5-b795-872b76f981d1"
                    }
                ],
                "resourceVersion": "91772",
                "uid": "5731c2ab-140b-4728-8317-ce11b6212bd2"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/golden-image-public-keywjlpxcsdry"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:20Z",
                        "message": "\"step-assert\" exited with code 1: Error",
                        "reason": "StepFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-79ccc7d720b1b8bd420e985e85452d70-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641758\",\"namespace\":\"\",\"successes\":3,\"failures\":11,\"warnings\":0,\"result\":\"FAILURE\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-91b4aa5d289f1f9e5550b0f93f489196-b6a2eb3d7aaeb276-01"
                },
                "startTime": "2026-05-13T03:09:07Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e97b97b95787f5acff0c6641b15bea34b431338bb595c3b0854b8c967d74c28b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:12Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3f352dd8842ff0396f152aaf296570826454b048c746881aa620f3eb16c7f923",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:12Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4747f1f156df6482b26c5e8a76f1c9ca95fcca2a316102257ad7b60dc6e5bd41",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:18Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea1ed3f139e551863c17be9eba2bf4c6f14df71ef738ebd09702a84212a7d25b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:19Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bc320265030ca2e8d765c4160c14a027e600b03851d268b988a5bf24c857e5c2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:19Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6023e9bc5955091d5315c0527d6806da11842c0fa1310e15b6dc33fb0c03faeb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d9abcc0169a4bc642ddf42ee9115180ba65ce34a5b4926d993920ecde2922a36",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f2031d3a594563c9d44f404873edfd8101ab41a7f704f1f64e1d7556f8821821",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://180dd404df59c2275034d09b21e3f5afe0a6b816cee636ff5b54993c0589f32c",
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:09:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641758\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]",
                            "reason": "Error",
                            "startedAt": "2026-05-13T03:09:20Z"
                        },
                        "terminationReason": "Error"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/golden-image-public-keywjlpxcsdry"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/e0fd127e-7217-4bfb-a530-8fb5f1db1b4f/records/7ceb8bf0-fa61-470b-a038-5179b5c502aa",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/e0fd127e-7217-4bfb-a530-8fb5f1db1b4f",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-1b1c873d0e9702b0d0fd7c2323f922fd-400d04e9bdaef754-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:01:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-q9vn8",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-q9vn8",
                    "tekton.dev/pipelineRunUID": "e0fd127e-7217-4bfb-a530-8fb5f1db1b4f",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-q9vn8-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-q9vn8",
                        "uid": "e0fd127e-7217-4bfb-a530-8fb5f1db1b4f"
                    }
                ],
                "resourceVersion": "81571",
                "uid": "7ceb8bf0-fa61-470b-a038-5179b5c502aa"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:06:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:06:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-5f1268ec6b8b52dead5f38cb06abffe5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641573\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-1b1c873d0e9702b0d0fd7c2323f922fd-400d04e9bdaef754-01"
                },
                "startTime": "2026-05-13T03:01:54Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fe4bc561a0dd5885694e25c076195a7dae1f65d98f212f06f4b2a97c3b51a76f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:07Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://76ef8c8a99dde9f7ac78770a4486a42a992fde1e0b21e748fb09940200f0b164",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0f680e0221c6881ea1159523551c8f44ec308b4b283f7eb9c3166e460c12a5ff",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:14Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://00d21d406a8b4380fea681b31008c6a67c966ca1d6c69bcc4a04fd4ef1415ce4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9e385b9bba1ba602cca166812e4c30e57c0f2364da569e57d771b4b55fba6e94",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8d3135a783af32cb0040a06a048c73bcba5d6d6a0e8a23a79d42cbd7e4896f8f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://76c3e5d72d53015748081904816c4dad837d6fbc305d1d9044f215f64f926a3d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:16Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f57b549b8354ea74bc1ec2fdf81f74e682805f525c4b56cb338778d6136d8cc2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:16Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:16Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dba59266b8d6b8a9acd6712505006a7f55935a40afc2ad9e552f74ae7d0e8102",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:16Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641573\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:16Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-xqbvpimkbm@sha256:728eb56cf7ef7b26c63470cd8d4fab56109e15ccade4c1d948308d5cd36a7489\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/cosign-public-key"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "chains-e2e-nvqm/results/0bdbf48b-4e56-4904-9a93-38c3150a9bd7/records/a6dfa7b0-09d9-45bd-8b75-ed4795710587",
                    "results.tekton.dev/result": "chains-e2e-nvqm/results/0bdbf48b-4e56-4904-9a93-38c3150a9bd7",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/displayName": "Verify Enterprise Contract",
                    "tekton.dev/pipelines.minVersion": "0.19",
                    "tekton.dev/tags": "ec, chains, signature, conftest",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b8014c76e47dd2d761b8208d739b2b70-cc3867449bba56d9-01\"}"
                },
                "creationTimestamp": "2026-05-13T03:09:23Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "app.kubernetes.io/version": "0.1",
                    "appstudio.openshift.io/application": "",
                    "kueue.x-k8s.io/priority-class": "konflux-default",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "verify-enterprise-contract-run-qrkfk",
                    "tekton.dev/pipelineRun": "verify-enterprise-contract-run-qrkfk",
                    "tekton.dev/pipelineRunUID": "0bdbf48b-4e56-4904-9a93-38c3150a9bd7",
                    "tekton.dev/pipelineTask": "verify-enterprise-contract",
                    "tekton.dev/task": "verify-enterprise-contract"
                },
                "name": "verify-enterprise-contract-run-qrkfk-verify-enterprise-contract",
                "namespace": "chains-e2e-nvqm",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "verify-enterprise-contract-run-qrkfk",
                        "uid": "0bdbf48b-4e56-4904-9a93-38c3150a9bd7"
                    }
                ],
                "resourceVersion": "93511",
                "uid": "a6dfa7b0-09d9-45bd-8b75-ed4795710587"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGES",
                        "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}"
                    },
                    {
                        "name": "POLICY_CONFIGURATION",
                        "value": "ec-policy"
                    },
                    {
                        "name": "PUBLIC_KEY",
                        "value": "k8s://chains-e2e-nvqm/unpinned-task-bundle-public-keyuexmojzsap"
                    },
                    {
                        "name": "SSL_CERT_DIR",
                        "value": "/var/run/secrets/kubernetes.io/serviceaccount"
                    },
                    {
                        "name": "STRICT",
                        "value": "true"
                    },
                    {
                        "name": "EFFECTIVE_TIME",
                        "value": "now"
                    },
                    {
                        "name": "IGNORE_REKOR",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "konflux-integration-runner",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "verify-enterprise-contract"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:09:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:09:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "verify-enterprise-contract-660d09d800efb516180a575b979160d9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce"
                        },
                        "entryPoint": "verify-enterprise-contract",
                        "uri": "quay.io/conforma/tekton-task"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641775\",\"namespace\":\"\",\"successes\":3,\"failures\":0,\"warnings\":16,\"result\":\"WARNING\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-b8014c76e47dd2d761b8208d739b2b70-cc3867449bba56d9-01"
                },
                "startTime": "2026-05-13T03:09:24Z",
                "steps": [
                    {
                        "container": "step-initialize-tuf",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "initialize-tuf",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8a2a5577e299b350da09dd37096529f48edc467d920bf24d6db3a882873ee030",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:28Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-reduce",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "reduce",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0862ca5891403e45bb4cbbaeb1e300eb118167684c2a9f33fdb59a34d30ca5bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-validate",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "validate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9caa59f64f1924af71acccc7ac0892b06c632c88aa35d6716c0a0980e3bfb761",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-report-json",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "report-json",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://48ec600badea096e9adc36e3522708f1811b1c6dad876c55f255ea04e30b5d95",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-summary",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "summary",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a55887e5649ce2528573a5331f78223b67d09b65eb90d1899db6acf18ac82554",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-version",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "version",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://014092b5883317ae856dd9438a629322cc8c8c858aff028a5269ff87fadcadbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-show-config",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "show-config",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://21fea2b2309e64ae71a85ae9ae7a0d2484f6485b6b5e6faee77d7f26dd35e8dd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-detailed-report",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "detailed-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c53a60845b2b9c718f3a5d49681e19ddf94799082e810a71745116fc9fc0d12d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-assert",
                        "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                        "name": "assert",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b5974cae43c1aded09debfa6772d92708ee767dd8cf0da4dde79c2a1b1d333cc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:09:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641775\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:09:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Verify the enterprise contract is met",
                    "params": [
                        {
                            "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n  {\n    \"components\": [\n      {\n        \"containerImage\": \"quay.io/example/repo:latest\"\n      }\n    ]\n  }\n```\n\nEach `containerImage` in the `components` array is validated.\n",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "default": "enterprise-contract-service/default",
                            "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n",
                            "name": "POLICY_CONFIGURATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.",
                            "name": "PUBLIC_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Rekor host for transparency log lookups",
                            "name": "REKOR_HOST",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_IDENTITY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.",
                            "name": "CERTIFICATE_OIDC_ISSUER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.",
                            "name": "CERTIFICATE_IDENTITY_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.",
                            "name": "CERTIFICATE_OIDC_ISSUER_REGEXP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.",
                            "name": "IGNORE_REKOR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.",
                            "name": "TUF_MIRROR",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n",
                            "name": "SSL_CERT_DIR",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIGMAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.",
                            "name": "INFO",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.",
                            "name": "STRICT",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Value for the HOME environment variable.",
                            "name": "HOMEDIR",
                            "type": "string"
                        },
                        {
                            "default": "now",
                            "description": "Run policy checks with the provided time.",
                            "name": "EFFECTIVE_TIME",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"",
                            "name": "EXTRA_RULE_DATA",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Number of parallel workers to use for policy evaluation.",
                            "name": "WORKERS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created",
                            "name": "SINGLE_COMPONENT",
                            "type": "string"
                        },
                        {
                            "default": "unknown",
                            "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n",
                            "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS",
                            "type": "string"
                        },
                        {
                            "default": "1s",
                            "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")",
                            "name": "RETRY_DURATION",
                            "type": "string"
                        },
                        {
                            "default": "2.0",
                            "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")",
                            "name": "RETRY_FACTOR",
                            "type": "string"
                        },
                        {
                            "default": "0.1",
                            "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")",
                            "name": "RETRY_JITTER",
                            "type": "string"
                        },
                        {
                            "default": "3",
                            "description": "Maximum number of retry attempts",
                            "name": "RETRY_MAX_RETRY",
                            "type": "string"
                        },
                        {
                            "default": "3s",
                            "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")",
                            "name": "RETRY_MAX_WAIT",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Short summary of the policy evaluation for each image",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "HOME",
                                "value": "/tekton/home"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "sigstore",
                                "initialize",
                                "--mirror",
                                "",
                                "--root",
                                "/root.json"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "initialize-tuf",
                            "when": [
                                {
                                    "operator": "notin",
                                    "values": [
                                        ""
                                    ]
                                }
                            ]
                        },
                        {
                            "command": [
                                "reduce-snapshot.sh"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNAPSHOT",
                                    "value": "{\"application\":\"\",\"componentGroup\":\"\",\"components\":[{\"name\":\"\",\"version\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}"
                                },
                                {
                                    "name": "SINGLE_COMPONENT",
                                    "value": "false"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE",
                                    "value": "unknown"
                                },
                                {
                                    "name": "CUSTOM_RESOURCE_NAMESPACE"
                                },
                                {
                                    "name": "SNAPSHOT_PATH",
                                    "value": "/tekton/home/snapshot.json"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "reduce",
                            "onError": "continue"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "1800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_CONFIGURATION",
                                    "value": "ec-policy"
                                },
                                {
                                    "name": "PUBLIC_KEY",
                                    "value": "k8s://chains-e2e-nvqm/unpinned-task-bundle-public-keyuexmojzsap"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER"
                                },
                                {
                                    "name": "CERTIFICATE_IDENTITY_REGEXP"
                                },
                                {
                                    "name": "CERTIFICATE_OIDC_ISSUER_REGEXP"
                                },
                                {
                                    "name": "REKOR_HOST"
                                },
                                {
                                    "name": "IGNORE_REKOR",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKERS",
                                    "value": "1"
                                },
                                {
                                    "name": "INFO",
                                    "value": "true"
                                },
                                {
                                    "name": "EFFECTIVE_TIME",
                                    "value": "now"
                                },
                                {
                                    "name": "EXTRA_RULE_DATA"
                                },
                                {
                                    "name": "RETRY_MAX_WAIT",
                                    "value": "3s"
                                },
                                {
                                    "name": "RETRY_MAX_RETRY",
                                    "value": "3"
                                },
                                {
                                    "name": "RETRY_DURATION",
                                    "value": "1s"
                                },
                                {
                                    "name": "RETRY_FACTOR",
                                    "value": "2.0"
                                },
                                {
                                    "name": "RETRY_JITTER",
                                    "value": "0.1"
                                },
                                {
                                    "name": "HOMEDIR",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "SSL_CERT_DIR",
                                    "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount"
                                }
                            ],
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "validate",
                            "onError": "continue",
                            "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n  validate\n  image\n  --images=\"${HOMEDIR}/snapshot.json\"\n  --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n   [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n   [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n  # If *any* of the above are non-empty assume the intention is to\n  # try keyless verification\n\n  if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n    cmd_args+=(\n      --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n    )\n  elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n    )\n  fi\n\n  if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n    )\n  elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n    cmd_args+=(\n      --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n    )\n  fi\n\n  # Force --ignore-rekor to false since we need rekor\n  cmd_args+=(\n    --ignore-rekor=false\n  )\nelse\n  # Assume traditional signing secret verification\n  cmd_args+=(\n    --public-key=\"${PUBLIC_KEY}\"\n    --ignore-rekor=\"${IGNORE_REKOR}\"\n  )\nfi\n\ncmd_args+=(\n  --rekor-url=\"${REKOR_HOST}\"\n  --workers=\"${WORKERS}\"\n  --info=\"${INFO}\"\n  --timeout=0\n  --strict=false\n  --show-successes=true\n  --show-policy-docs-link=true\n  --effective-time=\"${EFFECTIVE_TIME}\"\n  --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n  --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n  --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n  --retry-duration=\"${RETRY_DURATION}\"\n  --retry-factor=\"${RETRY_FACTOR}\"\n  --retry-jitter=\"${RETRY_JITTER}\"\n  --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n  --output=\"json=${HOMEDIR}/report-json.json\"\n  --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'"
                            ],
                            "command": [
                                "sh",
                                "-c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "report-json",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                ".",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "summary",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "version"
                            ],
                            "command": [
                                "ec"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "version"
                        },
                        {
                            "args": [
                                "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}",
                                "/tekton/home/report-json.json"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "show-config"
                        },
                        {
                            "args": [
                                "/tekton/home/text-report.txt"
                            ],
                            "command": [
                                "cat"
                            ],
                            "computeResources": {},
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "detailed-report",
                            "onError": "continue"
                        },
                        {
                            "args": [
                                "--argjson",
                                "strict",
                                "true",
                                "-e",
                                ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n",
                                "/tekton/results/TEST_OUTPUT"
                            ],
                            "command": [
                                "jq"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d",
                            "name": "assert"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The workspace where the snapshot spec json file resides",
                            "name": "data",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/912b5861-c603-4ebe-835e-19425f329aa1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-899d1bf59bd4f285-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:58Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mat576e97aa3143899f2029106b62bda63f-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174931",
                "uid": "912b5861-c603-4ebe-835e-19425f329aa1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat576e97aa3143899f2029106b53296f6c15d7cd3e2e46ddce4e08b2a5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:03:10+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-899d1bf59bd4f285-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f223c7a4a02415614cb50f1a0ef98f1b1408b139b322bcba09f3627fa842e7c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:10Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:10+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/19ff4abd-bba8-449d-83e8-883a7a1e4e07",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-70804009023c97e9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mat6e9629d639d14442141b51afd08b4518-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174143",
                "uid": "19ff4abd-bba8-449d-83e8-883a7a1e4e07"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat6e9629d639d14442141b51af6251bea872ebf6ba673956e8c8a61ece-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:02:55+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-70804009023c97e9-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://32d17110cabffea8caf1ff240112c23c981da2fcf322cbea200ba67f64fe2caa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:55+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/c262176e-37ef-470e-aeed-44db5788725e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-1c4836c135b60ec8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mat7c5a26eacb72403745f42b9b4f60d9f0-deprecated-base-image-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "177534",
                "uid": "c262176e-37ef-470e-aeed-44db5788725e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat7c5a26eacb72403745f42b9bae0355a3d06bf8e3bd26397adb606a9e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:03:57+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-1c4836c135b60ec8-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://92564c4b7449490564f31550dd2f832d4d02d07a1f64886ea820a1cfe929793a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:57+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/4a63249f-8320-4170-9fc1-1a38668fca69",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-d1c719db356eeecf-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-576e97aa3143899f2029106b62bda63f-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "169158",
                "uid": "4a63249f-8320-4170-9fc1-1a38668fca69"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-luzmlw"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-576e97aa3143899f20c317dd1f666aa120ac5dd0fc609bb0df-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-d1c719db356eeecf-01"
                },
                "startTime": "2026-05-13T03:59:43Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://96362da6bd0fdcf21723f53ba23b0f942be235612b8f1373af42c95fed438768",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:48Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e4d5c4ea08f35b1aca6ff10c67fba719d6e051dac314330eb60505fc540deb09",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:48Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea97f8d034a51c66990f8005acfb7bc0b39197432db2661c81a7abfab62fa2cc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:52Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b97c2be92192acc575df58b427cf5570045d6d3d2009eae4ace42442aae424ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:52Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:52Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/43791dd9-430c-4511-9ad5-6256ab98d855",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-a6e5d998afc3f980-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-requed9e60b36a3fb4eef8b0dc2939542450f",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "177202",
                "uid": "43791dd9-430c-4511-9ad5-6256ab98d855"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-r0cd4c39e46183dd6e48e8c6187bdf3d1-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-a6e5d998afc3f980-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://dd3031eda281b50d90d13a5a73c418909d8d2ef1570c60c10d3f1b6905cd3eed",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:39Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://d37206b7eb2e61a75cd73991c99889c6de2376756cd308eb9e977990e42e4843",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:39Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://feffa2141c9ebc68c8885d2c5cb0861f05a5f15be11ce06557aeb83ab3b84b8e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:39Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a450aa48d3be1e2c07850966695eecb775b17790616300f225057be7103a7506",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://fc5651cb027393baaec6d46ad5b0cf2e3f16d90a5578c3c66bf4ff04da78db04",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645025\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://35f8996cd4a37c0611446a3777872699b7782f7433fea550bd8c3e79fdcebfef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:47Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645025\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/a857a428-b06b-4b45-bcc4-bb68c7402b24",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-0aa49ebcb2491de5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "176157",
                "uid": "a857a428-b06b-4b45-bcc4-bb68c7402b24"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-0aa49ebcb2491de5-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d1628e1e2c496707ee1128e37ba414d20fb78843248a1493e628d747b80a9b53",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:35Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:35Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47",
                                "--digest",
                                "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/6fb4777d-ad00-44ca-afe7-f6af2929ced9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-10b9fd1051d239ec-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "175155",
                "uid": "6fb4777d-ad00-44ca-afe7-f6af2929ced9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:6115f1c1c0872e83cfbbb09af7fa64a85a16b99df40292136d925dd885c172c6"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-10b9fd1051d239ec-01"
                },
                "startTime": "2026-05-13T03:59:56Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9cd449a5e935a28f08cb6ab69852bd65bf27e513b09ecb1e2ff1c159c2013cd7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:05Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ae90052a2bd16f9fed1e2e5a2c2879d4b87cc1449a9880a385fa0306883e8246",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://67654f29c0469fe0899de7910665f5948b16dec9cf6272b29161566260be900f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:58Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://592828e04e174571f301fdc53b39496bb897ca3d9e6ad8a54583fadd667dbc91",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:08Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f7b7ebf90a09d5aaec93171d15b5e2c09e969bd4619ccdcc88cc017337e7c70d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:12Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a9d9d411772b30e3577391ea923e6c8ec6da676f158250971313c7a08124c425",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:17Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:6115f1c1c0872e83cfbbb09af7fa64a85a16b99df40292136d925dd885c172c6\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "frontend"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-frontend-on-pull-request-7vg5v-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/b5000a35-7863-4a6f-ba93-57ace8d65042",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-b6a413733f891f90-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:18Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "175820",
                "uid": "b5000a35-7863-4a6f-ba93-57ace8d65042"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-b6a413733f891f90-01"
                },
                "startTime": "2026-05-13T04:03:18Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://614e7e9a722fb68511f532416bdf0dac9c213820002f83be39e3b2f6c517638f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:26Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3613224c89d5bd26f7e2cffa4e25e3f280e26eaad7a671d3fad59407863ef9ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:27Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3360111d7217fdb8e274ff6f9f41f9b962c1c01109e0dd6e920bef9a6b7276c4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:30Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47@sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-frontend-on-pull-request-7vg5v-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/f90b846d-6a15-4bc0-a681-9956ff591822",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-7a04988ec0a2459d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "176944",
                "uid": "f90b846d-6a15-4bc0-a681-9956ff591822"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\":\"sha256:2247ad190b385a86a4c725ee01466028447d8ec4baa0f883740b017bc64145f3\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:44+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-7a04988ec0a2459d-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://18831e0020d435914c489d08c152e76a458311fc22f668c33b1cabcd02e3dd72",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:38Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://29d7b89b149e60624155dc0c67bf9fc6037bc5dce1818bbf6ab0da3135df183a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ff8fbec3c7c4b0f7380c8e72c028bf179b3092d23e2c1197527f8b43a8ff95bb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d6d1a5fecd631bbb84ffc3c7b8ffab6211444a361860fc0b491da5d02f65e00c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:44Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\":\\\"sha256:2247ad190b385a86a4c725ee01466028447d8ec4baa0f883740b017bc64145f3\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:44+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/f2a96ad5-2342-4407-957d-1014b033822f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-decd1298abd57a0d-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "177658",
                "uid": "f2a96ad5-2342-4407-957d-1014b033822f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778645038\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-decd1298abd57a0d-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1b97dca34e2cbd515d857d211ee3167565c5146240277b5c2ef6e5147ea503d4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:58Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645038\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://32da99f160a0bceac52a9210549ad232e4cc57d8778e791c05bd912b96210331",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:00Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645038\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/87228fd1-5936-42a1-b782-019b4d24d6e5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-22276b022d86f708-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:13Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "168823",
                "uid": "87228fd1-5936-42a1-b782-019b4d24d6e5"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "revision",
                        "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dshrqa"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644735"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "d9fd653"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-22276b022d86f708-01"
                },
                "startTime": "2026-05-13T03:59:14Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a44baeba93fb430d22f1fa8aea0a146fa31636fa9cc52bd3bab8973b671b45b2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:24Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644735\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d9fd653\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f0df3cf51539653e96604b7883ead48a16bba8acefbd04816d6501d8472fa2bc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:24Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644735\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d9fd653\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b37d182610debe084f1d364fd1f265df48ba941a8d2f0695f7ac2c8155bea5d9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:44Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132\",\"type\":1},{\"key\":\"commit\",\"value\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644735\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d9fd653\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:25Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/b4fe9484-8587-429f-9d52-23ec66580d3a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-cf187b5b2363a85c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:08Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "167936",
                "uid": "b4fe9484-8587-429f-9d52-23ec66580d3a"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:13Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:13Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-cf187b5b2363a85c-01"
                },
                "startTime": "2026-05-13T03:59:08Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://75b34bd5868d1cf65db2d5344d12771dff608e9a448c9187b6c954a02c0040aa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:12Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:12Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/ba7d53a0-8a87-4d96-bc3e-e7a387fbc90b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-c001aaaecc607175-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:46Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "169213",
                "uid": "ba7d53a0-8a87-4d96-bc3e-e7a387fbc90b"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-dshrqa"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-r539606ae215e37b4bb506bb921e2fc0a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-c001aaaecc607175-01"
                },
                "startTime": "2026-05-13T03:59:46Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://54018df53ee5139c98003172bc9ddff6c3c9a3cee40a69b029bce5d81cc28760",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:50Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e098462d6a7efaa9fb7ef7200bdd424013da9f96f9b7c48aaaeaddc62be93a63",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:51Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4df7e369448eca70f1497e7618d9f90a86091c389ad86d0a860cadb0a3b2f4a1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:54Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://75c4bde459ee1b870ba662ee42f17fb450038539a8dbd94355161d29d2c8e5c2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:55Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/7dedd7de-7bb6-4dc7-9969-52161b392033",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-34f6518b77eea0bb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "176591",
                "uid": "7dedd7de-7bb6-4dc7-9969-52161b392033"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:eaa44828d57f1376d9c37d716c89f808dac10886d4fa36fb3839078dc85d7c2b"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-34f6518b77eea0bb-01"
                },
                "startTime": "2026-05-13T04:03:32Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://925ce1ffbde8739e93ca89bb89865eb8efc05d35155ab08c96027f963ae07fe6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:40Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e79df0b34036371d1309c287818d1c9f030f294739ad1a00cc3116ce1aa00fe5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:41Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:eaa44828d57f1376d9c37d716c89f808dac10886d4fa36fb3839078dc85d7c2b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "frontend",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47",
                                "--image-digest",
                                "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/a4af4b66-d70a-4c62-ba2e-f1dd838f446a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-23a44e10aeb97941-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "177132",
                "uid": "a4af4b66-d70a-4c62-ba2e-f1dd838f446a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-rpms-signature-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\", \"digests\": [\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:46+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-23a44e10aeb97941-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91c7a4c396056518d7dc0235e565451b1b34f8b2f6c8b1ef3291bc1eda6964d9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://55a842eca7ee4b97bd6dc4195cd82d37c5d67e5ed5b82e629701da3ccbf26805",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:47Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47\\\", \\\"digests\\\": [\\\"sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:46+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/89ca0424-5862-491b-a3b1-0eb8ba5a3103",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-800e8dc2ac6149d6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "177141",
                "uid": "89ca0424-5862-491b-a3b1-0eb8ba5a3103"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:03:45+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-800e8dc2ac6149d6-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0783698c88dbaf386229af78ec0094083542af3e22e68a6b3b74c460df952012",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1c8e822f980eb09f4da951b9da1fce5ffe491402bcb95767c214727558e8e6c6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:45+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8798bf1345c9ce9719a4bf89b7b6d641b3e9d598487ff80adc364a197b7def8d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:45+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/a82f2c85-657b-45ad-a1e6-b55ed453d56d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-e65f776f96d84458-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "176668",
                "uid": "a82f2c85-657b-45ad-a1e6-b55ed453d56d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:03:41+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-e65f776f96d84458-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5a0533ea6439674237b2d7dd31c5a733f4e1fabc7b15570f9862cc4cdd1e7ab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:40Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91ed432f6cee6411f25a79b5666583a1ae2b7a6704b5e8e8d9a0bcd77d43404f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:41Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:41+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://08bc4fb2bc07a4659ecd787b7f260c61cc131ff7fead80aac225543ec7b9e7c0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:41+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/commit_sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-dshrqa",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-7vg5v",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551/records/70faa1de-1d02-41c7-a670-4fb538e3151e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"d9fd653be80fae94644d66d41a78dcc14154fc47\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-154f9c9c931af88cc5037b85c21ee3c8-fd3e2620890e94fd-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712739010",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "d9fd653be80fae94644d66d41a78dcc14154fc47",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-7vg5v",
                    "tekton.dev/pipelineRunUID": "08e1fe3d-384c-4ece-9ffa-2624206f6551",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-7vg5v-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-7vg5v",
                        "uid": "08e1fe3d-384c-4ece-9ffa-2624206f6551"
                    }
                ],
                "resourceVersion": "178488",
                "uid": "70faa1de-1d02-41c7-a670-4fb538e3151e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-7vg5v-sast-unicode-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:04:57+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-154f9c9c931af88cc5037b85c21ee3c8-fd3e2620890e94fd-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5cce99720311d08832f2d59490cedf14ad7eedc86aefb42488e8fe6c14ad918e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:40Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3dd782617fe4a52a943ac2932e9528da3abee671f6cd804d90c03876b39b0b2d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:57+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef2e1fdc32a689060d4cdd92d5b77bdc01505037bb15b593ba06d48db53ff933",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:57+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend@sha256:35508589f9779d5f8876fe13053ddccc0bfdf750515fcd58806ec584c263d132=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-frontend:on-pr-d9fd653be80fae94644d66d41a78dcc14154fc47"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5090693482e0c6c4b5475b1495f3bb166fee668fccd24111bdb555be46103db3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/5ac09c1b-b46e-4bfe-8f0e-4ae9da8a3bb2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-da75fd76961a0569-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-hi576e97aa3143899f2029106b62bda63f-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174858",
                "uid": "5ac09c1b-b46e-4bfe-8f0e-4ae9da8a3bb2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:09Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:09Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-hi576e97aa3143899fda62178ee3d13b162bf2537968350299-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:08+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-da75fd76961a0569-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2ff35218938997e887d870c474487b894649ba8496472767035ae37afbc5ced2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f30d3019511703dc4aac56c9ee0db91596ed99008dfd4cdef930c14d8b7d865c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:08+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/a1f7d5bf-32b5-4bcb-bed7-5881ca6b1eaf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-3cbf4b6fa4e46cba-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-his576e97aa3143899f2029106b62bda63f-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "178067",
                "uid": "a1f7d5bf-32b5-4bcb-bed7-5881ca6b1eaf"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-his576e97aa31438996a4fda9a831d3a802edc6f543e95c35b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:04:29+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-3cbf4b6fa4e46cba-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://077e4bd5a471d4d089245157e94fab9b755c6d8156e2374e5a0fb7121a3a1fcb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6ae18411f6341d700a78f60510eb5513ec78ada410bf6e42e9276c635d55d9d5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:29Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:29+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://69cbf2c15118de3beed176e67972195c29e09bdbff4d0aca3d338d88b5483b89",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:30Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:29+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/645f9be2-2f4d-4d96-af84-05740ff5cc1d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-9f4939b7206f6a5c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174736",
                "uid": "645f9be2-2f4d-4d96-af84-05740ff5cc1d"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4mgl2-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-9f4939b7206f6a5c-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f7b0ec78bc01a8eaabf3373823eeaf7a1280cea482c721e7606b3864a6f7a946",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:04Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:04Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a",
                                "--digest",
                                "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/4dd6487c-58c0-4d6e-bb62-eed6e7609a55",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-4d2c4c018c50a276-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:54Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "173811",
                "uid": "4dd6487c-58c0-4d6e-bb62-eed6e7609a55"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:44Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:44Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-539a6a606cd84c4f093c000290d0a44d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:1515f39e08ac4f14812cd4ceecac439f4c388ee5d9d063df0be2ae0b04f6360e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-4d2c4c018c50a276-01"
                },
                "startTime": "2026-05-13T03:59:54Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7c75754545af275bf1f1baedcc8c150f1fb2b362ae94adb1f9131a96b6bc467c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:04Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c908c04a56ad2fffbac9116961356ba82e03056992ed24b14e47e90993253986",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c23e6fedfd64a1920ab35f9979d4875d01d0fbb3755c231dcecdba6d9ed0db3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:31Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://64e2d8a7d89d89c349cd1157951b112628943b989e9c61fa8095c622dced7a1a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:35Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://68edfc5c33b94c9d4ab6d38a28cbe186f0b4e837f7540d2a768def9b9202b64a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:39Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f8ab331d31ffbbb1b979c2b3f53ec9d7acf6e180380ab52eb268b8385c3503f6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:43Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:1515f39e08ac4f14812cd4ceecac439f4c388ee5d9d063df0be2ae0b04f6360e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "history-worker"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-history-worker-on-pull-request-4mgl2-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/963ee6fb-0085-4b22-96f7-59240f50c75e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-343a6d22bde12e28-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:45Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174595",
                "uid": "963ee6fb-0085-4b22-96f7-59240f50c75e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-e52bf7a8c40896d24368638382e0b311-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-343a6d22bde12e28-01"
                },
                "startTime": "2026-05-13T04:02:45Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8633c4f46e1032fec97b20058f9c2a91a7a2a0f37c5604a5269d15814e533e5d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8802c5fceee6d218a5a07feb5c6be81a1f1bff43bc473e15d1c6b28bf4278fb2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:55Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://51b538915317ab9b8b53460400c198068eb59ada292848deb70dddd0c123e2a5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:58Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a@sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-history-worker-on-pull-request-4mgl2-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/58574246-bd86-4c96-bc49-d63d0639b920",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-fa922b391479eb3c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:58Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174972",
                "uid": "58574246-bd86-4c96-bc49-d63d0639b920"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4mgl2-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\":\"sha256:5d0da746f0f84334ef2ede92da02ecf7bd8d13c7ade522e7b92ec25df3024210\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:11+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-fa922b391479eb3c-01"
                },
                "startTime": "2026-05-13T04:02:58Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d73257f90fb448d89f81805fe147953e4d698094ef9d238df56f9c21836be79a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:06Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e16848ae33d22637e6b5ff75ef85b112b129c935cff6361bb07360591406a52",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:08Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:06Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e784fede9f0c4012b60b26e0e908d14a9e52cb5f732ae7cebeb0b1195fabdb2b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:10Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:08Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://174292ea9728932fa5049b9489e05624cc43a22c1b12fc58264fd3004811e34e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:11Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\":\\\"sha256:5d0da746f0f84334ef2ede92da02ecf7bd8d13c7ade522e7b92ec25df3024210\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:11+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/deae7b95-8792-45db-a7f8-bee95fe139e2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-8dd7e0d7f3ff08ae-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "175182",
                "uid": "deae7b95-8792-45db-a7f8-bee95fe139e2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:21Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:21Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4mgl2-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778644998\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-8dd7e0d7f3ff08ae-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://658f3218727bd94b4ac6ce56b2808f4a399149d58f71e5aa1b74e131d6f18cbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:18Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644998\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://73c1e5080f15aba0845918f78f946f1dc166830ef01b6cf3e85eeb9c83e24bd9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:21Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644998\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/3cbdf69f-a3f6-4cc9-b1c9-2701e44a8e09",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-d3f2f5f1d05a00f3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:08Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "168692",
                "uid": "3cbdf69f-a3f6-4cc9-b1c9-2701e44a8e09"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "revision",
                        "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-luzmlw"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-d5d3f58fea4cd9498944e25306d98b2f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644730"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "ce43081"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-d3f2f5f1d05a00f3-01"
                },
                "startTime": "2026-05-13T03:59:08Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3f369adcdca7a1cbef6872f3b91271d0fc0cec3f38ab49dbc44bcccaea88ac3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:19Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644730\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ce43081\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://76f1bab9bfa525ecdff793e972017ec08c610751ff8e7f2b129c975ec36166ab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:19Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644730\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ce43081\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6a10bfbecb7493c873f4257af7808a91324ecd0479bfcdf305b00c6401b4309c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:41Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1\",\"type\":1},{\"key\":\"commit\",\"value\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644730\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ce43081\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/def449ba-839d-41dc-b8ba-dcbe6d347704",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-18cb792334f18882-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:02Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "167700",
                "uid": "def449ba-839d-41dc-b8ba-dcbe6d347704"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4mgl2-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-18cb792334f18882-01"
                },
                "startTime": "2026-05-13T03:59:02Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4253e8baf5630861eae9f98c5870e1802df0ee86d10f10bc003fb05b1832cdc4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:07Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/8477bb42-2a63-4f36-807b-c5019948099d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-96e719e9ef0a53f6-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "175021",
                "uid": "8477bb42-2a63-4f36-807b-c5019948099d"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-26d0a9301c5135904d8117d317da9f33-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:2570d29a488801cadd80baf678a7c4b9eab997ec1f62dd3c7e4b1d97275a3c8e"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-96e719e9ef0a53f6-01"
                },
                "startTime": "2026-05-13T04:03:00Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://09041f5f0c5db57a927352156b0132fbc27b15f7fac210e3dd158337ae5c7386",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:13Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://96a9b9eccc0978dc0ede545f246d7850f449cd66109eea63f1f58800a60b8cef",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:13Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:2570d29a488801cadd80baf678a7c4b9eab997ec1f62dd3c7e4b1d97275a3c8e\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "history-worker",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a",
                                "--image-digest",
                                "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/253732dd-2067-44d5-ad9f-c84473257859",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-cc717cb71a182791-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "175010",
                "uid": "253732dd-2067-44d5-ad9f-c84473257859"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-9e191f5aaeaf3c6ba4f64d8eb64d5abf-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:03:12+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-cc717cb71a182791-01"
                },
                "startTime": "2026-05-13T04:03:00Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4649c75521962ff39f93f2ec81241a79fc1ea247c796e0ebd42855035c3bba3b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9b877a7ff192a2c37dc60ef4c7c08eaf7d1533675deb81b942d2c7a7c01c07a0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:12Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6db5a08fe61e6cf36d3125df0b86a53b5876578662cb018fb5216907b4f8c947",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:12+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:12Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/658d1b1f-3819-44fa-9515-2391bf6a107c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-506df198b66d0dbb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4mgl2-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174961",
                "uid": "658d1b1f-3819-44fa-9515-2391bf6a107c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-a0cdaa9d2698637ad170fe8c2b4d8195-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:03:11+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-506df198b66d0dbb-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91614edb0722029cdad74128dcd0719fc4d2cbc4b968a0993979aa914d37227b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fa3ac10c94c34b10378dd84862bc92fa83b7e58b10212f7930acd8fd47bcf3e9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:11+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://901a7f5c45b910f4fb6dff56dbeba69232ed6661bfddf01bc8d83e41e7c17d20",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:11+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker@sha256:638796425b1a46f3973666a0bf63ece89e3b21c3c032873931bbe2e3536f45d1=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/commit_sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-luzmlw",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4mgl2",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad/records/890e044f-7463-40f2-b9dc-993b7f75d4f1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"ce430815215e6628c4c4aea4a250a633bb59676a\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/f55d5018-6058-462d-a67c-a38997d676ad",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-9d8dbb0a240508fd3a7db2b75e26e298-ddde2ff001a87503-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:59Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712732314",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "ce430815215e6628c4c4aea4a250a633bb59676a",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4mgl2",
                    "tekton.dev/pipelineRunUID": "f55d5018-6058-462d-a67c-a38997d676ad",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pullbb79b5c61ec6b78dc910ad66b576c842",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4mgl2",
                        "uid": "f55d5018-6058-462d-a67c-a38997d676ad"
                    }
                ],
                "resourceVersion": "174966",
                "uid": "890e044f-7463-40f2-b9dc-993b7f75d4f1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-63d0e517cd67b68576e6d1765fca60ee-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644990\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-9d8dbb0a240508fd3a7db2b75e26e298-ddde2ff001a87503-01"
                },
                "startTime": "2026-05-13T04:02:59Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2d9285216f34f626fd53f3a4a32d55ff5cf71a9a90b7c5d1a1b0d4e216044ce3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:05Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://e19d304c6f56d5deedc82b5c4679eb9a4adfeeae7e9e6304488add65da70fb25",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4b7b5489c6e1d29423dc3d182c116d332888ae5e4c08c882c6483e4c60a8bb10",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:07Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f63f9430bd5e0e715c976f36dfe04515d3640952061e1aabffad2f0aca68f0f6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\", \"digests\": [\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644990\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://78564d74cfd21d23fb794c3bd8c3b30079748f1832ec5c988b9988e5dce9e775",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:10Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a\\\", \\\"digests\\\": [\\\"sha256:5fd7f5926b8c0624b5ad321fdc53a88bec04c67f206b7028b80203125185fa76\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644990\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644990\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://88d6b79916a903fdfcb5ad79a4385fb860fa40f31423cc6c3af5a0c63649cf44",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:11Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644990\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-history-worker:on-pr-ce430815215e6628c4c4aea4a250a633bb59676a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/80bab452-7402-44bf-b7bd-3e964dbc5909",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-82f1eeda94c7b93c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-reqe31540664801dfa8f40dca73c0dc6037",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174130",
                "uid": "80bab452-7402-44bf-b7bd-3e964dbc5909"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull98a590392c011b57977c94020f9d494b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644973\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-82f1eeda94c7b93c-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://027ef833460e46a146ec5fafd75bc0fa813fb1a137beb4244a52509b0e18cfdd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:51Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://6db7b2cb01bed569d55c42a3bf318bb3baaec197c831be934575ea9e74b01047",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:51Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a5816b008d658d37cb0e43be21fc98b0f35405c22d212d672b715fb0ccaa87ce",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:51Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1ac185800e0965445b7f51ff6d168d1f049b11105f4c10d55897f8e7036a4ead",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644973\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://47abacb683818e965d8624aa816c790b40901a5b5011f169104faf32ccbfcc4a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:53Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644973\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644973\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2615bc688ef0c4f567550a0db12246e07f8d95ad4f8661fd213725a7e6365e1c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644973\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/ce654d89-cd4a-4ace-a251-a89507f93e0f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-52005039ae6cef65-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-apply-tags",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "173991",
                "uid": "ce654d89-cd4a-4ace-a251-a89507f93e0f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-52005039ae6cef65-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c15a6fa12c4db7f65e7ba3b5fabbe425fe7cebca6fcd9b109d0e4272c875ac54",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                                "--digest",
                                "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/337a6de3-d57a-4c51-b5fb-a31d1d042273",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-2368d0c4cc74cc4f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-build-container",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "172977",
                "uid": "337a6de3-d57a-4c51-b5fb-a31d1d042273"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:26Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ff9d28acac12479a59978a8804483e533f36c7a9057885e8fbac14fcab71ed6c"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-2368d0c4cc74cc4f-01"
                },
                "startTime": "2026-05-13T03:59:49Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8e3a058adfe78c5b73b21d1cd1b3655df1c1f2944c7ae2b402d112c0b6fd0ee6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3ac6a70bcdd2431c929d181080eea2a255d063a1b02800cbb65315f007beeb02",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e9fc20597dde4a4263442cddae627fceb4e2492e0945bdd8717e27b90fb41243",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:01:38Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f29bd403c5ea6525a92df814af1920fdc9436120369a2d9904f1a985477f207c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:01:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://37a6717d8a69bb6fd9354f3e28069fbf85ffac6c8c0c3522503ff1b78d7da0d6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:01:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d4cf061d8158c9a6af2b3cd9be37cfaa0ce85132d6ba8263062c9edbf76b78fd",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:ff9d28acac12479a59978a8804483e533f36c7a9057885e8fbac14fcab71ed6c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:01:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "web-server"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-web-server-on-pull-request-8njx9-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/1933d0bd-9b7d-46ce-8763-986ec1753399",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-c9ab41b8a46b9514-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:27Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-build-image-index",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "173787",
                "uid": "1933d0bd-9b7d-46ce-8763-986ec1753399"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-c9ab41b8a46b9514-01"
                },
                "startTime": "2026-05-13T04:02:30Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7629c5ebae6ab0395bdd27aecac84f09c7bca927e41084b85a05bc2c5a76175a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://79d9bab8d70c9f22438e6b9389e55b9ea8d7a553480453664e08d33569adf915",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:40Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a8e54b0aba331633e25d32b4605b4ab1a39deb30f22c8f5b53bc294027242291",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:43Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55@sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-web-server-on-pull-request-8njx9-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/a718dacf-c7be-4fb1-b3d7-8e5648b53bf0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-6239f78a4e3dc507-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-clair-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174112",
                "uid": "a718dacf-c7be-4fb1-b3d7-8e5648b53bf0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\":\"sha256:c34047bc8f768b93181df9b15f51bd9f7bd2506b26454c580bbee2707f4fb361\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:02:54+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-6239f78a4e3dc507-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f965ea577b28e8b109034e81e0bdb0f647fe34ee6ac97fe4612fd3deb8c5a186",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://56cfa2eb2f62b6acbc440e7548b6ffe15284ccbce56d60a89b010002cc249cac",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d6e25d62b26ee28d2ff7897a80b8991370170e389ad7af3dd1bbc8fdab3ba78e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c35875d1e9c283855d2074946e121d586b1baf84c4700c1903d0f0275f751df9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\":\\\"sha256:c34047bc8f768b93181df9b15f51bd9f7bd2506b26454c580bbee2707f4fb361\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:54+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/ca12850e-aed9-44b7-bb91-b6aa82791f39",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-887207f9592e9b6f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-clamav-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174740",
                "uid": "ca12850e-aed9-44b7-bb91-b6aa82791f39"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778644982\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-887207f9592e9b6f-01"
                },
                "startTime": "2026-05-13T04:02:44Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b07701bc46008ea17dc375bced4933c00088589bfff80baba1638dff4a93da73",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:03Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644982\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7f3c37e2ac3f04375887cf7ccd5f5be1a59d78af4e26cdfad5d515abd8e17820",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:04Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644982\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/f80463b9-56d0-432f-abab-709099dad0c4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-e39ca8dd467c94db-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:03Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-clone-repository",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "168459",
                "uid": "f80463b9-56d0-432f-abab-709099dad0c4"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "revision",
                        "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tqbupz"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644726"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "597bd0d"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-e39ca8dd467c94db-01"
                },
                "startTime": "2026-05-13T03:59:03Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://683e88a70bc4455b3d716c7a3fde24105dbdc0a0a6f9152cc2bb64b64a8a98d0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:15Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644726\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"597bd0d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2a4e404d4c68c88412fe4142e88f09774a5d3ab1ef6be991df2c0e37c652eb97",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:15Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"commit\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644726\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"597bd0d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fe582bcddfea006c859d286bf031612192b1e0b25453795877adb5e5784371a6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:35Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f\",\"type\":1},{\"key\":\"commit\",\"value\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644726\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"597bd0d\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:16Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/c96abc82-c3d9-4c94-a8d2-3d6caa706005",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-083f38a94feb2685-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:58:58Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-init",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "167420",
                "uid": "c96abc82-c3d9-4c94-a8d2-3d6caa706005"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-083f38a94feb2685-01"
                },
                "startTime": "2026-05-13T03:58:58Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2533d10d2539652dcd26e693c86e021731a741f177af8c6ea34fd607041c3805",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:02Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/4b4f1243-0142-471e-b22d-439aaf5303d5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-83f4505b2807cffb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-prefetch-dependencies",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "168932",
                "uid": "4b4f1243-0142-471e-b22d-439aaf5303d5"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tqbupz"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull376dbacc1b75e87438c342a34de0a12c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-83f4505b2807cffb-01"
                },
                "startTime": "2026-05-13T03:59:37Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://27e09b7eae3630ba7e6abda8c9d9dec9c80d32425d3ca34d6afdc422e58cebc6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:43Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3dde3abdff2675622022b384674cc43e364cdf15930602fb236da77dd78a767e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:43Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fc50010c55b6490d64d59d95908fdb71a07e371d1b801e483320403a79faa815",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:46Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://42e17ec03d4c3aa6576dd46c430e0d79df78a06db281531bae41d3a5f5858be3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:47Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/3fa208be-a7e7-45f2-a0ac-181a577d51e8",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-e4b03416d4f4c654-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-push-dockerfile",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174087",
                "uid": "3fa208be-a7e7-45f2-a0ac-181a577d51e8"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:7c91935fbb71fa1f65ef0f39964a60459bc85ecb85c2257cb04a0d30da7f913b"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-e4b03416d4f4c654-01"
                },
                "startTime": "2026-05-13T04:02:44Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4d92609893e947aa455a72cd58ff4b7274b02cc6f76906472a5cbfce3e347d75",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://13765ee699e96a0860344624f92f9107a9e665c35871085fc8d8c1aaa2cb0476",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:52Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:7c91935fbb71fa1f65ef0f39964a60459bc85ecb85c2257cb04a0d30da7f913b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:52Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "web-server",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                                "--image-digest",
                                "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/df6ed74f-d2d3-452f-a828-2d187561e8d4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-4e3544c4a9b3c5fd-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-rpms-signature-scan",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174091",
                "uid": "df6ed74f-d2d3-452f-a828-2d187561e8d4"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull4d96525d971357c5448eb11dc6710a91-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\", \"digests\": [\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:02:53+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-4e3544c4a9b3c5fd-01"
                },
                "startTime": "2026-05-13T04:02:44Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://047c48637d0bc235182986729fce19acc59b38a3f5f436edf8119ba973f99c21",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a1322ebd89435d6717920e6f88539dc2f20169aef0082191e1987f8e14cc1d41",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:53Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\\\", \\\"digests\\\": [\\\"sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:53+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/4b2a6dd7-fcfa-4c6d-89a0-8b117f9d404c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-d93f67f930e81024-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-sast-shell-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174284",
                "uid": "4b2a6dd7-fcfa-4c6d-89a0-8b117f9d404c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:02:57+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-d93f67f930e81024-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://19b3cc2b16e76bd07b6c3d2ff0dd457cc42419a3903526aeb7f747abf679a5e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2391ee9fbbd3b71c131ba82f83310b7efc39c283c4ec9a04cf6d92de94409bbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:57+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b64ed3644d07fcd61cc2ab33d3440ca78914b3e84588cb178232aac9b43846ba",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:57+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/2ad72398-aef7-4bc1-ae75-4ba6fd78ab06",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-fdee5b5f7607f3fa-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-sast-snyk-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "174159",
                "uid": "2ad72398-aef7-4bc1-ae75-4ba6fd78ab06"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-8njx9-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:02:54+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-fdee5b5f7607f3fa-01"
                },
                "startTime": "2026-05-13T04:02:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c67d0fb90bcbac1fcd8496affd60046acdadf26d3a3671baa8c4f06f7c5883c4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4805408d0dfbb63c7d90988ed7d056900058255077e4cd75809d29700055e1e8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:54Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:54+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3c84bd0d4ab9b733d2b742e3e832b1c9be78410ad4c06cbf0fdeda9b677db026",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:55Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:54+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj?rev=597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/commit_sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqbupz",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-kokohazamar-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-8njx9",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj/commit/597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-rfgjbj",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5/records/78cc58fc-1bdf-4e87-a9ff-264385cd0d01",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-rfgjbj\",\"commit\":\"597bd0dcc4a6b39d708fba1a05b2eaaf40340d55\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-kokohazamar-backwards-compat-dr/results/ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8c5b8c6494be1ce30d5a01bda594abd2-01196a9a24683a58-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "kokohazamar-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712726188",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-rfgjbj",
                    "pipelinesascode.tekton.dev/sha": "597bd0dcc4a6b39d708fba1a05b2eaaf40340d55",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-8njx9",
                    "tekton.dev/pipelineRunUID": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-8njx9-sast-unicode-check",
                "namespace": "dr-test-kokohazamar-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-8njx9",
                        "uid": "ddf102ed-678f-4bbd-a1f7-28fd66cbfcc5"
                    }
                ],
                "resourceVersion": "178157",
                "uid": "78cc58fc-1bdf-4e87-a9ff-264385cd0d01"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pullc9e5b5edc43883b00093a49e0d9232c4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:04:34+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8c5b8c6494be1ce30d5a01bda594abd2-01196a9a24683a58-01"
                },
                "startTime": "2026-05-13T04:02:44Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e1a7d7e44f041a3e21516bcca9cb9b14afcb997a81f1b0c32f84bcbd4f1d33b8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:15Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://17657c8e09089dcc6ce0fa60d2604f9b89bbe2ce65d6a55ba519f4667ff55288",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:34Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:34+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:16Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0c2dc863c12fa26f880e31906c415a6970fc60178f9ff10bcc3811b248c87370",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:35Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:04:34+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server@sha256:f180a25b42c21b69b2dd54168dec9bfe260cc43c2405591132c0e4db66b8c16f=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-kokohazamar-backwards-compat-dr/mathwizz-web-server:on-pr-597bd0dcc4a6b39d708fba1a05b2eaaf40340d55"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:a6912657a28e51b5f9dfad60f636d78da7f544111e506e1ffd4991db2fe059b7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/6e7cb669-98b0-49c6-ae2e-79fd5a1dcc7f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-0478d00e4aabf35c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mat0ce9f9242151af0d47be4571598f0902-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177482",
                "uid": "6e7cb669-98b0-49c6-ae2e-79fd5a1dcc7f"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat0ce9f9242151af0d47be4571677c53f2c9ea00875662ea96713a6b73-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:03:55+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-0478d00e4aabf35c-01"
                },
                "startTime": "2026-05-13T04:03:35Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dc422429ebddacc0468ecc53c9b638400de8c39b6a9e28db365275b0673aab36",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:55+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/837fdc67-22e5-4cca-8d05-52ee6729f916",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-4f636a4c69826b24-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:42Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mat5e8f80341c2513c70f0296835ebcd8cb-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177440",
                "uid": "837fdc67-22e5-4cca-8d05-52ee6729f916"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mat5e8f80341c2513c70f029683d66dccb707b3cf6e0c5b035acfa639d3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:03:55+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-4f636a4c69826b24-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://27226454d5889f1589983cfc6560e14148a4531cceb248eb4771b6d321e77dd8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:55+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/3cb1ff35-256f-4861-aba7-9845b7cd2d2b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-a963701a9f029267-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "matbbabad6f290e6195112348dc76d3e478-deprecated-base-image-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173285",
                "uid": "3cb1ff35-256f-4861-aba7-9845b7cd2d2b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "matbbabad6f290e6195112348dc45175a66f564e211a617052c1cdcd114-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-13T04:02:35+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":2}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-a963701a9f029267-01"
                },
                "startTime": "2026-05-13T04:02:24Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5ca1efeb5909e5f6ee8f5519fbcdade93aefed311a4b222f0e78daa2eaafd4a8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:36Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:35+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":2}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/497f7a9f-84db-4dbc-acb7-08a1b1fa3e3c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-bde98d4295193492-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:29Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-bbabad6f290e6195112348dc76d3e478-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "168543",
                "uid": "497f7a9f-84db-4dbc-acb7-08a1b1fa3e3c"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-molqjn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-bbabad6f290e61951131d410b2ea699aaf278bfee1c8eaf487-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-bde98d4295193492-01"
                },
                "startTime": "2026-05-13T03:59:29Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2bec450c141125756d6fd93fb93939d292533825227e9182f73cc750af16f77b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:34Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3c9e004a42fdd308077d965b087e27a73ea3046d7fec8eb6695d915791da195e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:35Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3869345acc179e94cb935615133c15e049eecd321a0a58bd52d70ece0e9a22e5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:38Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://abb5a2b3836accc98bec8c18db8334067393918eec07e53b20e41d72f7d35063",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:38Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/d3f696dc-3255-486b-840d-7bfc9d075d95",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-0953382cda4f0f67-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-reque7fad1b2be62ebe3ce5ab3209da42a78b",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177444",
                "uid": "d3f696dc-3255-486b-840d-7bfc9d075d95"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-rb5188d0f72fa23765801c2eec0c6d594-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645034\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-0953382cda4f0f67-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://b70144b53675ccfb5a136be97554e5b4d501a8ed7ee33e74a796a0ac4b1e94f5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:48Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://1cf7c9693b4572c0532888b46d7e1eac84b34dbb21e65a315e5b87fd668e3aa8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:49Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7a9a9d8ab037681ec55cc812d45e0eb167d2bbfccbe341c87c1f84f4f3b1afad",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:49Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3a5e33139d898f54334a1671cfe194eb0fe1cf23dc3211e2e2809afc0dd6d53",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645034\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://4024ebe0064a979957f7e171648c33efa876191018c75b226d68660d03f5712e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:54Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645034\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645034\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://d8485c462c5fed73fe92988bfefa441aaea626fdb06729675296efe344c7b36e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:55Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645034\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/5cee85ba-37d4-4d23-88e3-321b198567ad",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-90a3602fb75ec0e4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177244",
                "uid": "5cee85ba-37d4-4d23-88e3-321b198567ad"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-90a3602fb75ec0e4-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://24eb14c328ae13018648bc05a5552df1f6cea745df016bb62515f7b70f3f1e9f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9",
                                "--digest",
                                "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/501c2a80-deac-463c-afdf-0a9ddda512b2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-b7c2f5c857f57ed4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:41Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "175686",
                "uid": "501c2a80-deac-463c-afdf-0a9ddda512b2"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:19f57547dc88e7a289d823a02a0912d1cf76e6fde437c16e602b9b9f8e31c665"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-b7c2f5c857f57ed4-01"
                },
                "startTime": "2026-05-13T03:59:42Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://afa124c1f5c605af1150ecbfe0db45a8c1f5bf579273302cc3b5b3cb58586c7d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:50Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://db432281d9ed44f151cdd1b4b52e3e1d05bdb92addda1dc2f32a89bc04e0fa6a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:51Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dba6322401cd26b555264693364612084beeaced76f191f9f59a0f770419c32c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:01:55Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://692f0eec50e54b2ab4e4fbd0e795f36e098c9eb365b6d65e1b38a4c31c74b0fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:22Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://636026905ca428d869b13b467d6006a061af4b47a8ac8abd3bd8825c59134073",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:27Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ba0e4966d0e006e707d92eaaf438e4511ec417def91b62690afb68a978494da3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:30Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:19f57547dc88e7a289d823a02a0912d1cf76e6fde437c16e602b9b9f8e31c665\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:27Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "frontend"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-frontend-on-pull-request-9jghc-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/fb589774-9652-4e29-9942-6975092265c4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-4be1c55ecf6c5720-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:31Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "176982",
                "uid": "fb589774-9652-4e29-9942-6975092265c4"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-4be1c55ecf6c5720-01"
                },
                "startTime": "2026-05-13T04:03:31Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1f85e430e5963d322c210c5abb6fefefda466694134f97d75fce7a94dcdf2297",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://099b8ce85bd25cca8101922b14eb2b2aa717858013e0840ccc249f3465deda77",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://926c1a303b5f8b169e89fb58d375c68e234dacf05649929bdf3a47f8f4f3dd18",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:41Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9@sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-frontend-on-pull-request-9jghc-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/e23e3be6-8789-41fd-b224-718ff81afb1f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-cf9510baf01b4913-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177437",
                "uid": "e23e3be6-8789-41fd-b224-718ff81afb1f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\":\"sha256:20f357ae0566757b85749fee483f9439277601ce6d7e53b33974460865b483c0\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:55+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-cf9510baf01b4913-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fde962e86305f3e65100c5ca937a11ba57b5e410edf11fb81add6f99e192b562",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c8c22d8ef48feb71c48e6468f013f72b7660ff95959986052c4b1b42e71b3444",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3043018f4e046a7ee0de2c8ee97965ce85cf2f6ed9aae5774702300b484bc81f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:54Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6dac6f1cab5798a0b1aa24b0c79ad50c1a3705810f973469254fbaac29d0ca38",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\":\\\"sha256:20f357ae0566757b85749fee483f9439277601ce6d7e53b33974460865b483c0\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:55+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/a00ba42a-51ac-4143-9c2d-f8fb211a29bc",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-f9df391105ef79b5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177754",
                "uid": "a00ba42a-51ac-4143-9c2d-f8fb211a29bc"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:09Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:09Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778645047\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-f9df391105ef79b5-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dff329c23adebbb99209fe831e8c4a1ab547321ff49451e0cb91135b2071d913",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:07Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645047\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9f7c3b930a3eca73f41c87ddc2644b43e906310f11e1012fb07e6567030e7c79",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645047\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/01363b7a-f76d-4093-b926-02ca13e3716e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-a0d89a4f4f715819-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:58:58Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "168321",
                "uid": "01363b7a-f76d-4093-b926-02ca13e3716e"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "revision",
                        "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-jxpfjj"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644722"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "888db83"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-a0d89a4f4f715819-01"
                },
                "startTime": "2026-05-13T03:58:59Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://85b7f339f6d8dd30c595f95f3fecabbd37ebd6283e25164dee8b0f535b6a689f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:09Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644722\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"888db83\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://61620d9ad00fdff3300afaf1e52514ce626c0f2aa27b8fad10be718161f56895",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:09Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644722\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"888db83\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://646c6957eb41d4ec907fde50305f8be47b8f612811bb2e720119027c92e2fe05",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:29Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8\",\"type\":1},{\"key\":\"commit\",\"value\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644722\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"888db83\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:10Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/2f82f54c-6918-4b1d-847a-68864d053215",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-3ac788d481de68d9-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:58:53Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "167090",
                "uid": "2f82f54c-6918-4b1d-847a-68864d053215"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:58:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:58:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-3ac788d481de68d9-01"
                },
                "startTime": "2026-05-13T03:58:53Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6ee15e6682b4e1f57af2065306c36ce47fbe2c1f212997e88bd35f27e411c032",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:58:57Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:58:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/f0816a5a-d82a-4e05-bb92-3dc34e45cd95",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-86792229dc4ab1a0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T03:59:30Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "168644",
                "uid": "f0816a5a-d82a-4e05-bb92-3dc34e45cd95"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-jxpfjj"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-ra8f52b4ff500df4ecc40ae24c013153a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-86792229dc4ab1a0-01"
                },
                "startTime": "2026-05-13T03:59:30Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5137a41d8d3a542e8b92fb86fd1546a71a590ab8be5a0d8ee2b4ae7f9f9e8195",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:36Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://626b7f2b33e242065590f8cb054088be9a8048c3aadb33c98ecc325909280e8a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:36Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bcfb9f27869d69e917b74f12dd0161b0ec23b97a7ba4d1a79221d8a7b9c7fd7d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:39Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3b69eeac2d5f4e767b0346a20ff114d37a808135347a69e40ca3a8f24bda6fb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:40Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/102d1945-39eb-4095-bd6a-1462bbbd41f6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-12e7e80691f8749c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177410",
                "uid": "102d1945-39eb-4095-bd6a-1462bbbd41f6"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "frontend"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:4a47ecbc821abb081ec697d0fec3003a0603d6f7804acbe9835691ae08deca7b"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-12e7e80691f8749c-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f9f0f4d8695c5128e7c338ea76d40e5535da11acc63e1cb0790b65e2585b1c4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:52Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a2506e2f6b372f07ca8151ee550cd463fc4dbee5711ec36378cdacf425865a6c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:53Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:4a47ecbc821abb081ec697d0fec3003a0603d6f7804acbe9835691ae08deca7b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "frontend",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9",
                                "--image-digest",
                                "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/3ccde922-59ed-4674-920f-27d399678f9e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-9b25ebb9f5b5f541-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177506",
                "uid": "3ccde922-59ed-4674-920f-27d399678f9e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-rpms-signature-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\", \"digests\": [\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:56+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-9b25ebb9f5b5f541-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9fdf5e146c33d07acbe0f27a0576ea44baafe58a9e64a9c19956ce306c5bfa49",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8b94dc8753a5ae8cc897b32d1c24166b70b0cf4178bc6a59d91604ec1ddc1007",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:56Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9\\\", \\\"digests\\\": [\\\"sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:56+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:56Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/5d62b4c5-0d87-4364-8b8b-aff655c63fb1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-e125cb97ff124854-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177657",
                "uid": "5d62b4c5-0d87-4364-8b8b-aff655c63fb1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:04:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:04:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:03:59+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-e125cb97ff124854-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://384b03928cc5e9582713ed44dcfd8f5a1a2df56021c8ad0354bf64e79946a39e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6cfe9213c000e868fa501a0c7e8c59abeda731b0f439a600c649bce1a171b583",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:59+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://96f2ee497b22420e6dd9c26dabd3da796b604c20e96435d75f19efdd402caf9d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:04:00Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:59+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/6583d1ae-f51e-4620-9874-671223731189",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-84545f8b3b84d372-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "177524",
                "uid": "6583d1ae-f51e-4620-9874-671223731189"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:03:57+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-84545f8b3b84d372-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://91d01440692de8cae2ff5104f74b903fda9161121999700f08d1c77d11001814",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:56Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://af791ed5a616c4684344df271ff436452cac1c4876457b8024739007417e28d2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:57+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://718984df69be467e69626fd74086aa1f1317aaff9e332ab49ec3e43a19afb427",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:57+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/commit_sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "build.appstudio.redhat.com/pull_request_number": "2",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-jxpfjj",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-frontend-on-pull-request-9jghc",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"frontend/***\".pathChanged() || \".tekton/mathwizz-frontend-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-frontend",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-frontend",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60/records/1df34c18-f2a5-421f-aac7-6505f971ca9f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"888db839ec98e2a8c106937f0e4e66f86480ecd9\",\"eventType\":\"pull_request\",\"pull_request-id\":2}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-432eed5347b3af9ee69e53a2d7390356-41985cd79b57ae72-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-frontend"
                },
                "creationTimestamp": "2026-05-13T04:03:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-frontend",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712720097",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-frontend-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "2",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "888db839ec98e2a8c106937f0e4e66f86480ecd9",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRun": "mathwizz-frontend-on-pull-request-9jghc",
                    "tekton.dev/pipelineRunUID": "2e1bb608-5223-4b78-b78e-2998090ffb60",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "9efa70041c6f541c0c7a03c12fd154337cfef475ab3f9cfb92dcb38958c1db"
                },
                "name": "mathwizz-frontend-on-pull-request-9jghc-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-frontend-on-pull-request-9jghc",
                        "uid": "2e1bb608-5223-4b78-b78e-2998090ffb60"
                    }
                ],
                "resourceVersion": "178831",
                "uid": "1df34c18-f2a5-421f-aac7-6505f971ca9f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-frontend",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:05:17Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:05:17Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-frontend-on-pull-request-9jghc-sast-unicode-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:05:15+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-432eed5347b3af9ee69e53a2d7390356-41985cd79b57ae72-01"
                },
                "startTime": "2026-05-13T04:03:43Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://466886f7f954bb0b189c7a93f345629b1c2cbba0e8dc431e18319e8d9e4c9ef4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:59Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2e8081d28cdc8a614dc00cf20b1cc6d1fb4b76fff375fab2b3e37bf8a85a0328",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:05:15Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:05:15+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:04:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a4211f8e844e02d68cc854a2169c72d8c1eff3d48c84ba2f53476c6fe1d66edc",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:05:17Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:05:15+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:05:16Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend@sha256:8475b63d32ed459296d31376b2e48cb2fede719b1499532c951b7a6be82a07d8=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-frontend:on-pr-888db839ec98e2a8c106937f0e4e66f86480ecd9"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:1164f763752ed456612a981ecccfe692f9513ffb66db304baec12d1a1b2501e0"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/0f27b275-bd92-4520-b179-e634d1425d20",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-19a8c9d847ed554f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:25Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-hibbabad6f290e6195112348dc76d3e478-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173334",
                "uid": "0f27b275-bd92-4520-b179-e634d1425d20"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-hibbabad6f290e61952e30899bda110231cf6a0be45e41a8df-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:02:36+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-19a8c9d847ed554f-01"
                },
                "startTime": "2026-05-13T04:02:25Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5c10ce332738b6f7e4c1c1baf8234025cee38350ab9505ef4282cfe957ad6165",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:35Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://09a890e6f72ceafe9d4d4df1d558e2d6aea083868a071a0f70f7b10e7f80543b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:37Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:36+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/d62a1b07-1852-43e5-b558-997b70762d95",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-8db353aecc69da2a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:25Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-hisbbabad6f290e6195112348dc76d3e478-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "177556",
                "uid": "d62a1b07-1852-43e5-b558-997b70762d95"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-hisbbabad6f290e619b6fe795f1d157fbc9a9cae801a96f8c0-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:57+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-8db353aecc69da2a-01"
                },
                "startTime": "2026-05-13T04:02:26Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://368478a246cd5f7eed6cacdf029d9a5ef06ecbeee96df69e8b05fc567711d0d3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2bc873e999f720d5e4a65e01a78cbba5cade18b4646a28dabe3d617141b3d443",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:57+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e0f5d6fedfac1262c56f17d1e6fcbe9839d17a56b558f27d6450e41451b35155",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:57+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/2c8be6ab-d8a9-424c-81ae-185963f73e30",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-e8e32bd205f31e25-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:25Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173170",
                "uid": "2c8be6ab-d8a9-424c-81ae-185963f73e30"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4cv7k-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-e8e32bd205f31e25-01"
                },
                "startTime": "2026-05-13T04:02:25Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cc534133448539ab1cfa4ac68a8a886234c5976bcf645f2db40b024ab5edfd4c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:30Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:29Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                                "--digest",
                                "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/67a80459-82c8-41e7-bf6e-250aef4f3977",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-c1c00f0ec40f4bf3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:59:40Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "171091",
                "uid": "67a80459-82c8-41e7-bf6e-250aef4f3977"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:01:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:01:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-c84d471e5d374ac69bdf2eaa1fe91b58-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:65caa9b814708d6f7a4f880181936edaf7ee78aee42f03ea940be26fe9cbc932"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-c1c00f0ec40f4bf3-01"
                },
                "startTime": "2026-05-13T03:59:40Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df5d78741f431a5d3e8688d11caf3a270b60bdbcf8f8b25d4d82b97fe8feb68f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e4847b671c49132df6fccbcfbdde9a82a099aed0ab518fed0061865090483ade",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:22Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://557793c434b21779edac9e5b0a8653ca7d83063cd9b3804a49271f6b029c7eb4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:50Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9dae6ce61a714e915b3d49e0dbd0d28acc9b102de02256c3e5fc44db9c04a8ec",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:53Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://387f3e95457ee4c7aeb12d8e1393c46d84f9491dbc7e0d0b9078368a63563be4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:01:11Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3c328a71435d3b818eb96dec6bd03f05063fd7e5d780a36b2617fb48acf12fad",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:01:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:65caa9b814708d6f7a4f880181936edaf7ee78aee42f03ea940be26fe9cbc932\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:01:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "history-worker"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-history-worker-on-pull-request-4cv7k-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/b5c4e8a8-636c-4ebe-83e9-83b8e2766c88",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-0e77b451f97ff896-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:01:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "172826",
                "uid": "b5c4e8a8-636c-4ebe-83e9-83b8e2766c88"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-1353d471f8e688afecbb622eecb7cf1a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-0e77b451f97ff896-01"
                },
                "startTime": "2026-05-13T04:01:16Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4372343183a23615983b0e3a34494ad88981ae8c642ee16552c6e3357bd28c04",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:19Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://149e1d859cd23c84a85637607d7430847c08c60126185a76cf24dd2dea9faa5a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:20Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c7497e78a748883c6db82339b5a65c6708425a44d29b10ba5dbb0583e8db5287",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:23Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f@sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-history-worker-on-pull-request-4cv7k-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/3f9b174f-dc1a-4135-b340-773a1774e87d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-a29d35f31e2a21fa-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173311",
                "uid": "3f9b174f-dc1a-4135-b340-773a1774e87d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:37Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:37Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4cv7k-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\":\"sha256:38e042be7f356f325090e3107289d10d8e4393f270770e5bc3671c02803b19ea\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:02:37+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-a29d35f31e2a21fa-01"
                },
                "startTime": "2026-05-13T04:02:24Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f744f51729114c5f561734e091adb0615dca5de6032c1177ef051099653fcdc3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://50d2528b663dadd4b0b8508d23f6476a979c1d8e614c8f8977c67d62091f37ce",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:35Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d4908c2eb7c02f2b5be3f398c9414a163ba515f0cf09d7b434f716b35f7f979e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5824fbdc8edc490f494632ae0bee3ba2b222bea1ef86e761c1fd074f872e96a4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:37Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\":\\\"sha256:38e042be7f356f325090e3107289d10d8e4393f270770e5bc3671c02803b19ea\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:37+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/dee8a12d-9f50-4192-8a8d-5eedfb8d8674",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-4324bf46e27ff860-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "174813",
                "uid": "dee8a12d-9f50-4192-8a8d-5eedfb8d8674"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4cv7k-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778644966\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-4324bf46e27ff860-01"
                },
                "startTime": "2026-05-13T04:02:29Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c35c35c1e53daf2c33ab587bab122eea0cf1422278771a7b5445be38a47108d2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644966\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0d67d5b12039c48f273fe5dbb647c15af6a932e47f64b36634763a9cb5e3b8d8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778644966\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/f4e8bc49-ef86-4e1e-a85d-8dda8f0c9381",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-0f19fc82a3f675bc-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:58:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "168250",
                "uid": "f4e8bc49-ef86-4e1e-a85d-8dda8f0c9381"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "revision",
                        "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-molqjn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:28Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:28Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-df0a5279c1b4fbfdf729b97e37a99f6b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644718"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "ff3edb7"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-0f19fc82a3f675bc-01"
                },
                "startTime": "2026-05-13T03:58:56Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6eb8629fdfff5fae7b683e7db9d4c942e3af9d1b1c024eec34f1da888d35d9db",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:06Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644718\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ff3edb7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0be4034ca064ef13bd657713e7a714d3dbaf6ff30b8c45194170743725fb9e49",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:07Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644718\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ff3edb7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:07Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://926b5dab464b2f3b66a0413c177f97be44481a41b066bed33c4c565ff895a8c9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:28Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd\",\"type\":1},{\"key\":\"commit\",\"value\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644718\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"ff3edb7\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/a56cd341-5989-4fbc-b8b7-a7a34599eedd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-3435bc067fef7c58-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T03:58:50Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "166895",
                "uid": "a56cd341-5989-4fbc-b8b7-a7a34599eedd"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:58:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:58:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-pull-request-4cv7k-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-3435bc067fef7c58-01"
                },
                "startTime": "2026-05-13T03:58:50Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e6e3ff36d6b3240ad661933c74cd164d500aa5559b5f0ede68e46e427acd1231",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:58:54Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:58:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/5e1b4e2e-0337-4b75-ad14-2f1b9c7187c9",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-2280f495989e77b3-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:25Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "174812",
                "uid": "5e1b4e2e-0337-4b75-ad14-2f1b9c7187c9"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "history-worker"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-00131e4cfe8b6411f4838b5abd3648b2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:962a93ec773a0f8fee18905cff9fd0e6fe269b0115d12956f0240f4c979d3459"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-2280f495989e77b3-01"
                },
                "startTime": "2026-05-13T04:02:25Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a0df6ac1ef5e7a06d474635c3673c20bd3a471282e0c325cb51fd37052b3592a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95fc5e23dfffdf3afb6c866f15c10a95bba1fa2de456ead2392e6f1728924f11",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:962a93ec773a0f8fee18905cff9fd0e6fe269b0115d12956f0240f4c979d3459\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:34Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "history-worker",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                                "--image-digest",
                                "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/1fe740ea-186c-4434-ac7a-44c0033f5fd3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-ef0ba5b71180ae51-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "174823",
                "uid": "1fe740ea-186c-4434-ac7a-44c0033f5fd3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-151414a71cb5d85dc2576659341e2213-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:02:38+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-ef0ba5b71180ae51-01"
                },
                "startTime": "2026-05-13T04:02:25Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df760a54e8fa81f3869a18be4148d72da5265c27bffeb786a3b4541a5f694b37",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://95c7d2271ad3c3e97d958d26c3bd50fe72ba52c388924fb79df96a90a37caf64",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:38+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b743c147afebd562ba18bc2b35b45198196099ac4a67a7338d15fd5ac0fd9740",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:07Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:38+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/449483e1-f5e0-4a87-b18b-0f481569a0e3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-6bd199d4dc208ad8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull-request-4cv7k-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173403",
                "uid": "449483e1-f5e0-4a87-b18b-0f481569a0e3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-a4ced608d01ced9a0757add946725232-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:02:39+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-6bd199d4dc208ad8-01"
                },
                "startTime": "2026-05-13T04:02:28Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://39a3b5fe6ba10c53f45b96ab670e27eb34990ef5bdc75ac88501d79be5b6e3cf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:37Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://30bff0e6112a48975df36ad1b4098762475313499810522f380f12cf1b4592b9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:39Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:39+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5b3248fce61933afeba423e7b45a9ec487aafcc478be5eebdf0cda6d8ba61242",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:40Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:02:39+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker@sha256:5410cf4c7f1576d59ec721fd3384bc8557f8443f7dc37c736329cd9df4e3f8fd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/commit_sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-molqjn",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-history-worker-on-pull-request-4cv7k",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"history-worker/***\".pathChanged() || \".tekton/mathwizz-history-worker-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-history-worker",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5/records/f5f81b61-e337-40f7-91c8-5eec773b3aef",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-deb3568278551c0d781c81c59937e535-0dca1023a9a40eda-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-history-worker"
                },
                "creationTimestamp": "2026-05-13T04:02:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-history-worker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712715254",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-history-worker-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRun": "mathwizz-history-worker-on-pull-request-4cv7k",
                    "tekton.dev/pipelineRunUID": "a50ac930-b295-45a1-8c8b-7cd72574b5b5",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "178ea6b5ef5d94a3022ad53d265c2f9b1bc2b70874f6a72251339a21796c17"
                },
                "name": "mathwizz-history-worker-on-pull28d65eb9b870e52f994f7c436be3e1a1",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-history-worker-on-pull-request-4cv7k",
                        "uid": "a50ac930-b295-45a1-8c8b-7cd72574b5b5"
                    }
                ],
                "resourceVersion": "173288",
                "uid": "f5f81b61-e337-40f7-91c8-5eec773b3aef"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-history-worker",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:02:36Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:36Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-history-worker-on-81ead8773646ecaa692b88a7414cffd4-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644955\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-deb3568278551c0d781c81c59937e535-0dca1023a9a40eda-01"
                },
                "startTime": "2026-05-13T04:02:25Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2018b5288ba6a3ab38092ac49ead4b99c14554967fd87b9dbec4767ea0e6f849",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:32Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://eb443f1d3d1540ad1e7759cf795c7940eba31b69631bf0648e30466df42f5538",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:32Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a03bb9b47c8a25dc192cbfe7b9319adc5a9e7dee516bc28a6944a38dea4180e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:33Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:32Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://529aa745faf829dfcb8ae803775c75d4c0793fca77b35e930cbed506313ba61f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\", \"digests\": [\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644955\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://b82a82b1c887c3c44779af3a848908d8cd89396d4f618100cb0d7fad3d31ae83",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:35Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f\\\", \\\"digests\\\": [\\\"sha256:8bcadde7a07013f261f2799226baedef693bbfc715928dc7661a64f9c8a8db69\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644955\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778644955\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://44700ad17217261828677f5ef21892165ef6a522f76fcfbcbb52430a78324673",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:36Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778644955\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:36Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-history-worker:on-pr-ff3edb77fa3b8fd45be35e2bd36b5e803eb0a01f"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/89c3870c-d7f1-4b3d-ba69-2cce1a3a002e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-6bd8de30368f7b2f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-req373ad1aa75c5a02ecf3c41f49b491965",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177110",
                "uid": "89c3870c-d7f1-4b3d-ba69-2cce1a3a002e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull230f83b6f64cd61032f39cf0d19803c9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-6bd8de30368f7b2f-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2dbe8ae4ef2db2ead639c3ea7d640c4c3a676a694ca005aee1125d04180c8d78",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://289d86ad6ade66ae788128d921b2d2e1e8a3012cca6f4cbeade061176064ec21",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9dee45b8e403e21ac7ed077eae467102ec507c72651cda84eb6ca6abd57082e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ef746d3c6b0abaf314e495a3d70e9bf89f4832abe6ffd1e40d597774e4b70af9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://a0d70e9516646174d64dc2693bf5227e58a0726ae3428f4f7e93a000571be10c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645025\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778645025\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":3,\"failures\":4,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://330ed1d59a9ded47e9fe1856e842b9fee82cb6543cbd09b3410c14058348c27e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778645025\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":3,\\\"failures\\\":4,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:46Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/7c8617f8-836b-4941-bb43-a0f8cb2883e7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-872da2a8fb8ec50f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-apply-tags",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "176615",
                "uid": "7c8617f8-836b-4941-bb43-a0f8cb2883e7"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-872da2a8fb8ec50f-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://883ba3daaed169e681e80d4267336dd1b70bb80e63292d7b88a146136ba61f2d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981",
                                "--digest",
                                "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/9e8f8aa8-8f8e-42d2-a6e1-afbad405290a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-4e8ad9d21eb4111e-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:00:00Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-build-container",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "175279",
                "uid": "9e8f8aa8-8f8e-42d2-a6e1-afbad405290a"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "681d9f65a7f50cb260ee576ccab551e11d63c549f1e1ef3d201da3c112855bd6"
                        },
                        "entryPoint": "buildah-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:42a0263eee3573c96cff4075890b8bbb7d0d34d0c2197001da8ad49d8930eae1"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-4e8ad9d21eb4111e-01"
                },
                "startTime": "2026-05-13T04:00:01Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d56416be8f80a27a480e2c70db7a6e2bbed9265fe3fd3b74cb484702b7628d5f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:00:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2907e0b72e1556fed652f387d35740caffe5cd749558c59360b28dbf72723b5d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:02:16Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:00:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f7b132221ca00e2600338c14f0a9553892f3713d36f5ee34d6579e03500ba994",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:12Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:02:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ebf9ececa74a7d03be9f7f9da1a56ee24801d832eb3e24aec4209bb444aeb3e2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:12Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://bc160d807d29f85b5714a8a19ff09d35067f8188f20341799b65cd2965343764",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:19Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0b62002526ceeff7a75bd116cd7af7fa0ee6094f160a15394b9aacae52041954",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:23Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:42a0263eee3573c96cff4075890b8bbb7d0d34d0c2197001da8ad49d8930eae1\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "4Gi"
                            },
                            "requests": {
                                "cpu": "1",
                                "memory": "4Gi"
                            }
                        },
                        "env": [
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "web-server"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                },
                                "requests": {
                                    "cpu": "4600m",
                                    "memory": "8Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n  # path is valid, do nothing\n  ;;\n*)\n  echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n  echo \"Source path: $source_dir_path\" \u003e\u00262\n  echo \"Resolved path: $context_dir_path\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --build-args)\n    shift\n    # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n    # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n    # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      build_args+=(\"$1\")\n      shift\n    done\n    ;;\n  --env)\n    shift\n    # Collect env entries of the form KEY=value\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      env_vars+=(\"$1\")\n      shift\n    done\n    ;;\n  --labels)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      LABELS+=(\"--label\" \"$1\")\n      shift\n    done\n    ;;\n  --annotations)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ANNOTATIONS+=(\"--annotation\" \"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n  jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n    tr -d '\"' |\n    tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/var/workdir/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n    -e 'H;1h;$!d;x' \\\n    -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n    \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e\"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n    -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n    -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n  buildah build\n  \"${VOLUME_MOUNTS[@]}\"\n  \"${BUILDAH_ARGS[@]}\"\n  \"${LABELS[@]}\"\n  \"${ANNOTATIONS[@]}\"\n  --tls-verify=\"$TLSVERIFY\" --no-cache\n  --ulimit nofile=4096:4096\n  --http-proxy=false\n  -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "600m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "mathwizz-web-server-on-pull-request-dfvh8-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1100m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/8950fb9c-94ee-4ff0-91fd-4189680529ae",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-41e00b6026a9e53e-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-build-image-index",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "176370",
                "uid": "8950fb9c-94ee-4ff0-91fd-4189680529ae"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-41e00b6026a9e53e-01"
                },
                "startTime": "2026-05-13T04:03:24Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e82434f22cb13fec755d92046167792f4cd211b2d5606c53c85322383e3d6a10",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:32Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ae6e7b1f7e94040948d3319046c2d4ddec96ebca1982b60fac7d9119bed9e4e5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:33Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://de49d433fa4f78fbdb8a57969d4b113c0ab6aea9543a1edf635392939b1f26b0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:35Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981@sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"mathwizz-web-server-on-pull-request-dfvh8-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/99f4353a-66bf-428e-8fa2-89a11dd8346a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-4705eb39af021dc8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:35Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-clair-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "176946",
                "uid": "99f4353a-66bf-428e-8fa2-89a11dd8346a"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\":\"sha256:5b7023b61f19fcea8f468a6b8f73370183a6f3552eccdfe9202f23be7b0c7c18\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:44+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-4705eb39af021dc8-01"
                },
                "startTime": "2026-05-13T04:03:35Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ff0f9feef3df89e5594f5f2822953601de88ee184e01d18faedbf9ba208e7706",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1f6cac052afcc3a5261ec45d330287eaaf2fe96cba93a9f07767d0e7f81bac4c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:43Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9be211063bd7029904fe58dd6431a61018ffa9194b626f2c9f3cd0ca0c46315c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d3e5b22e5c526ecc5b9eea0ffe4e4d99b6cedc9c33c47e44a2783c43bcb71a1c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\":\\\"sha256:5b7023b61f19fcea8f468a6b8f73370183a6f3552eccdfe9202f23be7b0c7c18\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:44+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/93a52a5c-e5c6-40e0-9aa2-ae166d7bd3a4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-1eb5e98676141604-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-clamav-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177555",
                "uid": "93a52a5c-e5c6-40e0-9aa2-ae166d7bd3a4"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778645036\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-1eb5e98676141604-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6bf158786ec062ab49e16a76461eb2c539f679ac55efb37c8b5b8b8c180f2eda",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:56Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645036\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7bb8ec2e3fc84b5b630ba976cfdc37e9e8613d850c6352a3518f23bafa4986e7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:59Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778645036\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/6dcb579b-82a8-4577-9c05-62c0ad8bbb11",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-9a5a12cd5a071c1b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:16Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-clone-repository",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "168933",
                "uid": "6dcb579b-82a8-4577-9c05-62c0ad8bbb11"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "revision",
                        "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-ibafnr"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407"
                        },
                        "entryPoint": "git-clone-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778644739"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "a3be381"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-9a5a12cd5a071c1b-01"
                },
                "startTime": "2026-05-13T03:59:16Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a7f20a8d0dde54f2c9d9243243fe3a5a337e87ace8cc57d14bec220102ea74b9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:26Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644739\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a3be381\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a4bd9ceaa9adcbbefeb2a3e67f8929adf008420606deacda2d8742a9ad0e05ab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:27Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"commit\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644739\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a3be381\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://3903de588a726d25c343e67bcc1a44d387d5345403e2081c83e107c6c882c6fa",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:47Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85\",\"type\":1},{\"key\":\"commit\",\"value\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778644739\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a3be381\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n  set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\n  if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n    echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n    echo \"--- Git Status ---\"\n    git status\n    echo \"------------------\"\n    exit 1\n  fi\n\n  # Check if there are changes staged for commit\n  if git diff --staged --quiet; then\n    echo \"No diff was found, skipping merge...\" \u003e\u00262\n  else\n    echo \"Merge successful (no conflicts found), committing...\"\n    if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n      echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n      exit 1\n    fi\n    MERGED_SHA=$(git rev-parse HEAD)\n    echo \"New HEAD after merge: ${MERGED_SHA}\"\n    echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n  fi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "CHECKOUT_DIR",
                                    "value": "/var/workdir/source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink; do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/7b015b1a-5d03-40c0-b2d2-d8d3cfa1c3d2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-5c3a063751f2fa85-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:11Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-init",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "168018",
                "uid": "7b015b1a-5d03-40c0-b2d2-d8d3cfa1c3d2"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-5c3a063751f2fa85-01"
                },
                "startTime": "2026-05-13T03:59:11Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d86407cfec1bd2ad3d2c6ddf37b2803c7a0873d95be074ad83ad30cca0e37bd1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:15Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:15Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/231ebfd6-3ee3-4798-9f37-91aeabaf4cec",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-0cb73330604339b2-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T03:59:49Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-prefetch-dependencies",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "169352",
                "uid": "231ebfd6-3ee3-4798-9f37-91aeabaf4cec"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "6h"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-ibafnr"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:59:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:59:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull2d8532162dfdf53c7b6e58afae0ad835-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-0cb73330604339b2-01"
                },
                "startTime": "2026-05-13T03:59:49Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b9d933c7a03b70a1d5dd85e8ba2104339b110ca1f6e6fc7da3b9b70c6cc9ae57",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:54Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a6f1506bbf4e926bc99ce3d70db73e09f8ccf2753793b49d37f2b9ebb4b4b387",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:54Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c7943d4652995027ac2c0844ff6cbd523758583f2f886eb1b56f5956d93695e5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:58Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://25d4c860c16bb878fca50a1a48038c7626183e8d9363b71a82abf3718d4d67c4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:59:59Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:59:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "6h"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/54b484dd-76e8-4ca2-bb62-4eef529c25bc",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-3d097fa6ffd9fb6f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-push-dockerfile",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177027",
                "uid": "54b484dd-76e8-4ca2-bb62-4eef529c25bc"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "web-server"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71"
                        },
                        "entryPoint": "push-dockerfile-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:a6fdc4f7e5077c0cc698b005109b374e59ca855846c122607912b19c110f964d"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-3d097fa6ffd9fb6f-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:1b8ca9fd2e9112a113c8a594dcf675b799ba26c20c685c0334300f60c268fdfa",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f3b9da25de4353890bf85b6106f77eb57a487abf45bd459797b1b28b1199b99b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f6280125e919957ca21fdfc3ac0e2e6cbd48d696e532a69941851e7e2d24500c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:a6fdc4f7e5077c0cc698b005109b374e59ca855846c122607912b19c110f964d\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "web-server",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981",
                                "--image-digest",
                                "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/059d8167-f151-48c2-ad1f-559b34330fd0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-e01aeb3b385f2ee0-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-rpms-signature-scan",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177151",
                "uid": "059d8167-f151-48c2-ad1f-559b34330fd0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pulled60702b7579386ccfc4bc4ecdbcdc03-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\", \"digests\": [\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:03:46+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-e01aeb3b385f2ee0-01"
                },
                "startTime": "2026-05-13T04:03:37Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6881c26cd65d820ebb69bcbe4b84d617b6b799fdf43c74a2b13e8d7a85e9ac8e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5833fb098089070964a5e5cef7ba8b89b48be1f29dae749f26c53290623002d9",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981\\\", \\\"digests\\\": [\\\"sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:46+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/4ef5b931-276f-4e39-a7ee-0a56a4e9e7bd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-4c67669c8ae8d259-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-sast-shell-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177311",
                "uid": "4ef5b931-276f-4e39-a7ee-0a56a4e9e7bd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:50Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:50Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c4ef47e3b4e0508572d266fb745be7e374c29dc02580328cbe9f4d472a8aca57"
                        },
                        "entryPoint": "sast-shell-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"2026-05-13T04:03:48+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":9,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-4c67669c8ae8d259-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7591125721b97a750cc1b5287856d6c64d01b4f3da0874ee28cddb57d349fc7b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4719c9f258ee37e53ddf1d4a8d4c723e29696bd6c672371b4f6619464b34ae2c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:48Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:48+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4f30e236c55a8d34195af74aa0c102b37347233e5b29285d1a02c6b571bb9182",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:49Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:48+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":9,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/9f267c1c-f174-4d8a-9cde-f78b4e781749",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-abe784dcf28bb8a7-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-sast-snyk-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "177201",
                "uid": "9f267c1c-f174-4d8a-9cde-f78b4e781749"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:03:47Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:03:47Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pull-request-dfvh8-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "8f3ecbeaff579e41b8278f82d7fabac27845db17a8e687ea6c510c0c9aceabbb"
                        },
                        "entryPoint": "sast-snyk-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T04:03:46+00:00\",\"note\":\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-abe784dcf28bb8a7-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://b5af0bcedea0b1edd2385b7981abcf3afda743d3ab6c92a11699a515def467c5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ca2c49cfd8580cac046a237449600e9f30d171ebd386cc8a506712c216a9f7ab",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:46Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:46+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4e8b16a353e2e5eaf09adae5cec93682a04280388a697d6ba132ce78742efdbb",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:47Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T04:03:46+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check-oci-ta skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262 \u003e\u003estdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/var/workdir\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) |\n    csgrep --mode=json --strip-path-prefix=\"source/\" \\\n      \u003esast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003efiltered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if ((total_files \u003e 0)); then\n    coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n    --set-scan-prop snyk-scanned-files-success:\"${supported_files}\" \\\n    --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n    filtered_sast_snyk_check_out.json \u003esast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e\"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check-oci-ta\" sarif \"$RESULT_SARIF\" || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check-oci-ta success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n  if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach to ${IMAGE_URL}\"\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd?rev=a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/commit_sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "build.appstudio.redhat.com/pull_request_number": "3",
                    "build.appstudio.redhat.com/target_branch": "main",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "main",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ibafnr",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/dr-test-moshekipod-backwards-compat-dr/tekton.dev~v1~PipelineRun/mathwizz-web-server-on-pull-request-dfvh8",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"main\" \u0026\u0026 ( \"web-server/***\".pathChanged() || \".tekton/mathwizz-web-server-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update mathwizz-web-server",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd/commit/a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-mathwizz-web-server",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/DR-MathWizz-kohyxd",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70/records/41b7191a-a14b-4a73-89ee-4cb28e8ae2f0",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"DR-MathWizz-kohyxd\",\"commit\":\"a3be381f6dba56303dd182b50e82c228de19a981\",\"eventType\":\"pull_request\",\"pull_request-id\":3}",
                    "results.tekton.dev/result": "dr-test-moshekipod-backwards-compat-dr/results/1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7fe6fb502450e04db71c6b106f71c688-119de9c439572593-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-mathwizz-web-server"
                },
                "creationTimestamp": "2026-05-13T04:03:36Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "moshekipod-backwards-compat-dr",
                    "appstudio.openshift.io/component": "mathwizz-web-server",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75712745660",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "mathwizz-web-server-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "3",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.dr-mathwizz-kohyxd",
                    "pipelinesascode.tekton.dev/sha": "a3be381f6dba56303dd182b50e82c228de19a981",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRun": "mathwizz-web-server-on-pull-request-dfvh8",
                    "tekton.dev/pipelineRunUID": "1e5db1be-ee52-4590-a11a-8725e9222d70",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta",
                    "test.appstudio.openshift.io/pr-group-sha": "6382b0d2d207976a29048c8e4cb1fef47a2b7ad47dc2357e9246ec817759af"
                },
                "name": "mathwizz-web-server-on-pull-request-dfvh8-sast-unicode-check",
                "namespace": "dr-test-moshekipod-backwards-compat-dr",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "mathwizz-web-server-on-pull-request-dfvh8",
                        "uid": "1e5db1be-ee52-4590-a11a-8725e9222d70"
                    }
                ],
                "resourceVersion": "178609",
                "uid": "41b7191a-a14b-4a73-89ee-4cb28e8ae2f0"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-mathwizz-web-server",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T04:05:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:05:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "mathwizz-web-server-on-pulle79c8654a87bb98d25bdbb1188d36db1-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T04:05:00+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-7fe6fb502450e04db71c6b106f71c688-119de9c439572593-01"
                },
                "startTime": "2026-05-13T04:03:36Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0cf6c1640011bd02c158e2c4fe9f8c4656b9aa751c08fc879d0a99bfb87d0789",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://20226c664dfc566343771b0c504fe4b88eabf341bd5bea4fb7030e362123aaa8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:03:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c8a3503dcfd442ebcd7680c9b675e1b04237cf0de8ead52175cd2c6e8aade816",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:05:00Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:05:00+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:03:45Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7ea5dd12d02d00d46a3fe7410ccb5b6fa1fdb17b24692c937a22d97deaa210f0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T04:05:01Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T04:05:00+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T04:05:01Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server@sha256:07511db94e1b8d2d7a26048457ed4c6a3ef45b0491b924239858871abdf67b85=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/dr-test-moshekipod-backwards-compat-dr/mathwizz-web-server:on-pr-a3be381f6dba56303dd182b50e82c228de19a981"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f0ad6922093914fe35f7ed87a83ff859bd10ec7917163c86b76ddd65be2f90d9"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/bd06a693-a840-41c0-bcce-b02188fc0115",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-af6591da29957e0b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-99389d163f4809ac0a204ca19df83a99-deprecated-base-image-check",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "85748",
                "uid": "bd06a693-a840-41c0-bcce-b02188fc0115"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-99389d163f4809ac0a204ca177d617bcbab36428bd56e8073b87bc08-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:07:40+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":1,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-af6591da29957e0b-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:3bba1fe5ad96bd3811f34b367487192683aa9b1ba343da4885dda565b0a7207e",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5535c54b2f32788a73cd137bf58447cab0e32013bf994d5d30afc3693a35b37",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:41Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:40+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":1,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/40a3a9d3-ad26-46d7-82d4-9059a3bbeb3c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-c7c36da7fd96e991-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-req9a57264e0c4aaa9f4683d5c822f82db7",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "89526",
                "uid": "40a3a9d3-ad26-46d7-82d4-9059a3bbeb3c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull23089b8f7e635f14ca248d66006934a2-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641717\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-c7c36da7fd96e991-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://55e65ac6b38d1990b04c328a688684c8e48c16477ae6c012e42a88a8ab7ffe3b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://85dbc53760a7ff45cf2993841f84e02b101805d78acc2655aa14a59fc0922083",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5dca0a8aff5937ac0d0b858a8d18c4bc0de8a6987e9212395cb59b95c633f589",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:33Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c208ff6cb8b1ec6e21fe6b9f92df4b270be49ffdf817cc6716fa2aca269e5939",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:36Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641717\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://e0430b50847e1e7b46da14eb57c78338b5f65538ea7fea344ca341e83a6d2963",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:37Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778641717\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641717\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://2ea3d23b76aac1e76d49df9472164e10d5ea2bb1e027fb4beb8cc77196d6800e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:38Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778641717\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/7a42e274-9f67-449e-bcc1-3723a3bfadcc",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-3a6e02e1bfe9596b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-apply-tags",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "85327",
                "uid": "7a42e274-9f67-449e-bcc1-3723a3bfadcc"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-3a6e02e1bfe9596b-01"
                },
                "startTime": "2026-05-13T03:07:28Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2cd412c82111c8f3b5a6fc7eea78b50bfb9a7b56f571ff8dae04ff3553a4f589",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384",
                                "--digest",
                                "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/a2b98ca4-3825-4387-9d72-93027055ff84",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-2422e3bce7c14ada-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:05:42Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-min",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-build-container",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "83913",
                "uid": "a2b98ca4-3825-4387-9d72-93027055ff84"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "docker/Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "go-component"
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-min:0.9"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:12Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:12Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "83455b969b5b0f5e8cd96708b393343123754ec01d3d3cdaf531208693978a50"
                        },
                        "entryPoint": "buildah-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:30b11dfd9c4aa5826646afb11add49c70eb3fc003cbab1739171cd3160e181cc"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-2422e3bce7c14ada-01"
                },
                "startTime": "2026-05-13T03:05:43Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a592783f58471d322d8fcfd9c28f23f9b2dd47b545157289f8ab38603c7e19a5",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:23Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dff4f769b57597bc9b371ee3d93656391c65f21a3879f8c9e06dd8d4679e9a5c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:37Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:23Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a6512c79e5882ca5201e41c9b7a2794c2c0e859a3ca30c32af69960356bd343b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:00Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://eff0d0d4097e444e22921554fbedf676fe2f7ae5d62dbf344133879796c7f0e3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:07Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f2b243cbeeb723daecd638d555c4b17379458555d1aa03db6a9c360b4a385c2e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:12Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:30b11dfd9c4aa5826646afb11add49c70eb3fc003cbab1739171cd3160e181cc\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:08Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "2Gi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "512Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "go-component"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "docker/Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "go-component-thsjux-on-pull-request-fszpw-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "10m",
                                    "memory": "128Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/e49029b2-f27f-479c-87dd-deddc0a728f1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-4010c6794dc491eb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:13Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-build-image-index",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "85118",
                "uid": "e49029b2-f27f-479c-87dd-deddc0a728f1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-build-image-index-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-4010c6794dc491eb-01"
                },
                "startTime": "2026-05-13T03:07:13Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://09e9eb47023d33e1800251b94d27356fcdbc7ddafd0ffc3f974aedd949998211",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:22Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://d673c9110955ed04b10bc532dcb9a1fbf15b516ed084f75c2d41fd5a8b99ed43",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:22Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://48b2706c6fb7365ae9cfbdc723cd61adf99bc94a95446eeba864f208ef8f6b28",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:25Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:23Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384@sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"go-component-thsjux-on-pull-request-fszpw-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/a9cb329d-7749-4759-902a-5dcd6a516ea3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-cebf8a670aaa903b-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-clair-scan",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "87221",
                "uid": "a9cb329d-7749-4759-902a-5dcd6a516ea3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:05Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:05Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\":\"sha256:a257921b4cee83cf35f9ad62939d6782554161efa169010fc73e8f6bfc4d0943\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":342,\"medium\":857,\"low\":235,\"unknown\":2},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":19,\"medium\":475,\"low\":610,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:05+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-cebf8a670aaa903b-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://188beed21d2b1349af13bb3eb84b5c1510ff259d0e88728fdc22ac2c7e2f464b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://50532a173db28c5c6ef13615b0e2dee93cd4ebcc3baea48e3a53520b94286aee",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:00Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c34c2b3993fe7e0330fb2e87e903e744425d9bd7aad99e42b6e5440d89cf9080",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:02Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7657fc75d34f45f5c5e45a93da937fec70dc15bbf23410f01450aa3fe0adebb6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:05Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\":\\\"sha256:a257921b4cee83cf35f9ad62939d6782554161efa169010fc73e8f6bfc4d0943\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":342,\\\"medium\\\":857,\\\"low\\\":235,\\\"unknown\\\":2},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":19,\\\"medium\\\":475,\\\"low\\\":610,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:05+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:03Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/8c915825-74af-4a66-8bea-4bcb58cf2875",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-29af123881f29d0f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-clamav-scan",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "99578",
                "uid": "8c915825-74af-4a66-8bea-4bcb58cf2875"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:11:02Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:11:02Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641860\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-29af123881f29d0f-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://5a36e20012f969c26f5a37800df013311e0b4f173f75340a3a12689d06d8fae2",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:00Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641860\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dfa92a25128735c65c6f9eec829b5e5c71d5547dc3d53843823443cc9b7c8d66",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:11:02Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641860\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:11:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/e2decb03-8455-47ab-839e-ecacf0b08204",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-210a587acf32e561-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:05:21Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-clone-repository",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "80103",
                "uid": "e2decb03-8455-47ab-839e-ecacf0b08204"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                    },
                    {
                        "name": "revision",
                        "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    },
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tqkyjm"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:05:32Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:32Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-clone-repository-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641502"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "63e7183"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-210a587acf32e561-01"
                },
                "startTime": "2026-05-13T03:05:21Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f5893db8ef53dab0809b44ee3ab9e03661392185338c0ceb5727eb410b29867a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:30Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/group-snapshot-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641502\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"63e7183\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/group-snapshot-multi-component\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://66f4ab5702b8449ca3e8dec21e6f1c19b693aa2854cf2f2abc7c4c8e0397d1e0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:31Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/group-snapshot-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641502\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"63e7183\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/group-snapshot-multi-component\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:31Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/910723f2-fe05-49d1-a3f2-4deabc37ec7a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-c4139ace717ffda8-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:05:15Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-init",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "79802",
                "uid": "910723f2-fe05-49d1-a3f2-4deabc37ec7a"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:05:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-c4139ace717ffda8-01"
                },
                "startTime": "2026-05-13T03:05:15Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://da9aa90cb5c998f3b1b8e6be3e6a44e19fc3efe28209a5e4028e0372df4a202b",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:19Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/e70db63b-bfa9-4fc0-b199-443be78c9762",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-cb6fad82f17b5bdf-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:05:32Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-prefetch-dependencies",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "80585",
                "uid": "e70db63b-bfa9-4fc0-b199-443be78c9762"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    },
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-tqkyjm"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:05:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull32a5a9ce266975434cb79c8d730d255f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-cb6fad82f17b5bdf-01"
                },
                "startTime": "2026-05-13T03:05:32Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8478fd96babf6646c706e9a335d19c22e5fc3ff31294333dd999d13ed4a315c8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/5738d389-4244-47a0-a6c9-f74c9ce4a364",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, appstudio",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-b8ae07a467fc45dc-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "tekton.dev/task": "push-dockerfile",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-push-dockerfile",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "85596",
                "uid": "5738d389-4244-47a0-a6c9-f74c9ce4a364"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "docker/Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "go-component"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:35Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:35Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-push-dockerfile-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:3616b6bb1647f26a72ccd4557e36f05a4a4e35da328bbd3156cca856a89f2d80"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-b8ae07a467fc45dc-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://42ed6e0f430baf7410727fcaa01c21986d72b37d180b0185848a1645f1771805",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:34Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux@sha256:3616b6bb1647f26a72ccd4557e36f05a4a4e35da328bbd3156cca856a89f2d80\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                "go-component",
                                "--containerfile",
                                "docker/Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384",
                                "--image-digest",
                                "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/4a0bc1f9-a650-4c5a-9a15-1ec18930ce8b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-ef4cfe1b11cbd2ab-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-rpms-signature-scan",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "89666",
                "uid": "4a0bc1f9-a650-4c5a-9a15-1ec18930ce8b"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:08:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:08:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pullf48ab1e59cc430a7d6a1fa5c3c29deb7-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\", \"digests\": [\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 419, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:08:44+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-ef4cfe1b11cbd2ab-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://9d3c7c48836303dc642d76add0f00b9a340aa6911cc679282d26eaa20ea328ca",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://38760a364e15707ee23e631e7835a7321127de4af19c44ef7e5546fe1a9ce8b1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:08:45Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384\\\", \\\"digests\\\": [\\\"sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 419, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:08:44+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:08:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/824009aa-393d-4271-a065-2df7bbfb4665",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-ebdee75c4a3230e2-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-sast-shell-check",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "87036",
                "uid": "824009aa-393d-4271-a065-2df7bbfb4665"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check:0.1@sha256:2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:59Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:59Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-sast-shell-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        "entryPoint": "sast-shell-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:07:56+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-ebdee75c4a3230e2-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://a84a5d991ee45e9e1c764be63c00874aee8495436b2833cb3f8fe6315beedb77",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:57Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:56+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:5da32f9d64fdb2a960792e282f739e9d398a69e4c43d7183323ea8a13b845c73",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ecf75c9c7769f28316eb298830e835b38bffda7e5a61ba050be51801928dd7d1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:56+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/workspace/workspace/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n    read -r quota period \u003c /sys/fs/cgroup/cpu.max\n    if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n        export SC_JOBS=$(((quota + period - 1) / period))\n        echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n    fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n    --mode=json\n    --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n    # predefined list of shellcheck important findings\n    CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n    CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n    CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n    CSGREP_OPTS+=(\n        --event=\"$CSGREP_EVENT_FILTER\"\n    )\nelse\n    CSGREP_OPTS+=(\n        --event=\"error|warning\"\n    )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e \"$OUTPUT_FILE\"; then\n    echo \"Error occurred while running 'run-shellcheck.sh'\"\n    note=\"Task sast-shell-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e \"${OUTPUT_FILE}.filtered\" 2\u003e \"${OUTPUT_FILE}.error\"\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n        mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003e shellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:6a46c5960cbcb81d9f6b0206163102d6f2e9e649ec231136f9ee33c02d3c1ad0",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n    echo 'No image-url or image-digest param provided. Skipping upload.'\n    exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n        echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n        continue\n    fi\n\n    # Determine the media type based on the file extension\n    if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n        MEDIA_TYPE=\"application/json\"\n    else\n        MEDIA_TYPE=\"application/sarif+json\"\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n      exit 1\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/23c567bd-dd73-4e25-bd50-ac32421be841",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-92b461d6c217dabb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-sast-snyk-check",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "86802",
                "uid": "23c567bd-dd73-4e25-bd50-ac32421be841"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4@sha256:566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull-request-fszpw-sast-snyk-check-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        "entryPoint": "sast-snyk-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T03:07:55+00:00\",\"note\":\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-92b461d6c217dabb-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://48addc5de7fdf48528589fc6df56026fe12c4c53b9191850e407b6a5f69b9fe6",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:55Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:55+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://2763c99cfa15e1631f507d506ca86f9c67f1b7593308d28535e84f072eab9804",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:55Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:55+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262\u003e\u003e stdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/workspace/workspace\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd  \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) \\\n    | csgrep --mode=json --strip-path-prefix=\"source/\"  \\\n    \u003e sast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003e filtered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if (( total_files \u003e 0 )); then\n      coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n                      --set-scan-prop snyk-scanned-files-success:\"${supported_files}\"  \\\n                      --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n                      filtered_sast_snyk_check_out.json  \u003e sast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e \"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check\" sarif \"$RESULT_SARIF\"  || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n    if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach to ${IMAGE_URL}\"\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component?rev=63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/commit_sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "build.appstudio.redhat.com/pull_request_number": "22019",
                    "build.appstudio.redhat.com/target_branch": "love-triangle-vezhmk",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-4e6fb92a80",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "love-triangle-vezhmk",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-tqkyjm",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/group-ehgf/tekton.dev~v1~PipelineRun/go-component-thsjux-on-pull-request-fszpw",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"love-triangle-vezhmk\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-thsjux-pull-request.yaml\".pathChanged() )",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/sha-title": "e2e test commit message",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component/commit/63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-thsjux",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16/records/1ddc3dc7-ee28-4b8b-866f-b50b62b68ba7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"group-snapshot-multi-component\",\"commit\":\"63e7183ffb4e05bf1b16da631c2c203c2db34384\",\"eventType\":\"pull_request\",\"pull_request-id\":22019}",
                    "results.tekton.dev/result": "group-ehgf/results/9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-713ae871186738890b181d21019d52dc-f9256b88d87f8452-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-go-component-thsjux",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:07:26Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-qwjc",
                    "appstudio.openshift.io/component": "go-component-thsjux",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707753690",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "go-component-thsjux-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "22019",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.group-snapshot-multi-component",
                    "pipelinesascode.tekton.dev/sha": "63e7183ffb4e05bf1b16da631c2c203c2db34384",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "group-snapshot-multi-component",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRun": "go-component-thsjux-on-pull-request-fszpw",
                    "tekton.dev/pipelineRunUID": "9a3b5844-374e-43e1-9bea-57f04b7bce16",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check",
                    "test.appstudio.openshift.io/pr-group-sha": "35a2e978a474d2452c2c69d17138644c5af2bb1b53740af7e78fd7f35dd9d1"
                },
                "name": "go-component-thsjux-on-pull-request-fszpw-sast-unicode-check",
                "namespace": "group-ehgf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "go-component-thsjux-on-pull-request-fszpw",
                        "uid": "9a3b5844-374e-43e1-9bea-57f04b7bce16"
                    }
                ],
                "resourceVersion": "86563",
                "uid": "1ddc3dc7-ee28-4b8b-866f-b50b62b68ba7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-go-component-thsjux",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check:0.4@sha256:c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-524971bf6b"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:07:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:07:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "go-component-thsjux-on-pull6b7ff313fa9b3210de6a6870bd9cc495-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        "entryPoint": "sast-unicode-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:07:49+00:00\",\"note\":\"Task sast-unicode-check success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-713ae871186738890b181d21019d52dc-f9256b88d87f8452-01"
                },
                "startTime": "2026-05-13T03:07:26Z",
                "steps": [
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://f4a57e5a8fd61dd646185048716f7e92f213678b82ad1856a8c8a3fb1fad9a85",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:49Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:49+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8bd6aad79169e978602461213aa1a9c464a84700680a6280b75a9f402db7762f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:07:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:07:49+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:07:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/workspace/workspace"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n    \u003eraw_sast_unicode_check_out.txt \\\n    2\u003eraw_sast_unicode_check_out.log \\\n    || FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n    echo \"Failed to run find-unicode-control command\" \u003e\u00262\n    cat raw_sast_unicode_check_out.log\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n    echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n    --mode=json\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"${SCAN_PROP}\"\n    --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003e processed_sast_unicode_check_out.json 2\u003e processed_sast_unicode_check_out.err; then\n    echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n    cat processed_sast_unicode_check_out.err\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # Build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    # Append --record-excluded option if RECORD_EXCLUDED is true\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003e sast_unicode_check_out.json 2\u003e sast_unicode_check_out.error\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n        mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n    else\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003e sast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n    note=\"Task sast-unicode-check success: No finding was detected\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s  sast_unicode_check_out.sarif ]]; then\n    note=\"Task sast-unicode-check success: Some findings were detected, but filtered by known false positive\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n    echo \"sast-unicode-check test failed because of the following issues:\"\n    cat sast_unicode_check_out.json\n    TEST_OUTPUT=\n    parse_test_output \"sast-unicode-check\" sarif sast_unicode_check_out.sarif  || true\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/group-ehgf/go-component-thsjux:on-pr-63e7183ffb4e05bf1b16da631c2c203c2db34384"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:553331dea0d954f8ad20e424140e15689a6b4139d512b579ddcb27af576d1609"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0;\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n\n    if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/ecc0044a-6bea-41a5-a87d-ab2562b12cfb/records/fc687653-5705-42a3-ae0f-41fc77cb89f5",
                    "results.tekton.dev/result": "mintmaker/results/ecc0044a-6bea-41a5-a87d-ab2562b12cfb",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-55eeee63f89ead13d4103872eb04e634-fa19e9dd55fc6316-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:17Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-btzn",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-parent-base-payf",
                    "mintmaker.appstudio.redhat.com/component": "gl-multi-component-parent-payf",
                    "mintmaker.appstudio.redhat.com/git-host": "gitlab.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "gitlab",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-vnes",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "abc4977aa5b7",
                    "mintmaker.appstudio.redhat.com/repository": "konflux-qe_build-nudge-parent-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-3df2b54e",
                    "tekton.dev/pipelineRun": "renovate-05130400-3df2b54e",
                    "tekton.dev/pipelineRunUID": "ecc0044a-6bea-41a5-a87d-ab2562b12cfb",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-3df2b54e-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-3df2b54e",
                        "uid": "ecc0044a-6bea-41a5-a87d-ab2562b12cfb"
                    }
                ],
                "resourceVersion": "173136",
                "uid": "fc687653-5705-42a3-ae0f-41fc77cb89f5"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-3df2b54e",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-3df2b54e-4bed9330",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-3df2b54e",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-3df2b54e"
                        },
                        {
                            "name": "secret-renovate-05130400-3df2b54e-4bed9330",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-3df2b54e"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:29Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-3df2b54e-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-3df2b54e-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-55eeee63f89ead13d4103872eb04e634-fa19e9dd55fc6316-01"
                },
                "startTime": "2026-05-13T04:00:17Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-3df2b54e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:23Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-3df2b54e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:28Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step renovate terminated as pod renovate-05130400-3df2b54e-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:17Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-3df2b54e",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-3df2b54e-4bed9330",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-3df2b54e",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-3df2b54e"
                        },
                        {
                            "name": "secret-renovate-05130400-3df2b54e-4bed9330",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-3df2b54e"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/1bcacf35-2024-4d3d-8412-3c4bb3010a14/records/f0bcca14-ce47-4c7b-a5e5-a7b2b19bc5b6",
                    "results.tekton.dev/result": "mintmaker/results/1bcacf35-2024-4d3d-8412-3c4bb3010a14",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-08b603558ccf9ff1a093f7922f82ded3-6935e75d7f25227c-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:16Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-rgcb",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-parent-base-vcod",
                    "mintmaker.appstudio.redhat.com/component": "gh-multi-component-parent-vcod",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-mpxn",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "e138e16c5024",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-parent-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-4bbc0044",
                    "tekton.dev/pipelineRun": "renovate-05130400-4bbc0044",
                    "tekton.dev/pipelineRunUID": "1bcacf35-2024-4d3d-8412-3c4bb3010a14",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-4bbc0044-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-4bbc0044",
                        "uid": "1bcacf35-2024-4d3d-8412-3c4bb3010a14"
                    }
                ],
                "resourceVersion": "172850",
                "uid": "f0bcca14-ce47-4c7b-a5e5-a7b2b19bc5b6"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-4bbc0044",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-4bbc0044-cba7b16b",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-4bbc0044",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-4bbc0044"
                        },
                        {
                            "name": "secret-renovate-05130400-4bbc0044-cba7b16b",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-4bbc0044"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:26Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-4bbc0044-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-4bbc0044-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-08b603558ccf9ff1a093f7922f82ded3-6935e75d7f25227c-01"
                },
                "startTime": "2026-05-13T04:00:16Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-4bbc0044-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:22Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-4bbc0044-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:26Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step renovate terminated as pod renovate-05130400-4bbc0044-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:16Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-4bbc0044",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-4bbc0044-cba7b16b",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-4bbc0044",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-4bbc0044"
                        },
                        {
                            "name": "secret-renovate-05130400-4bbc0044-cba7b16b",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-4bbc0044"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/ad84449d-3046-46bf-be45-bc4086962b3b/records/1a489847-e20e-4d31-8e1b-31ef1b837920",
                    "results.tekton.dev/result": "mintmaker/results/ad84449d-3046-46bf-be45-bc4086962b3b",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-e8383a399f1cab93afed4b66e0d4a5ec-84278f740956ce10-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:15Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-rgcb",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-child-base-vcod",
                    "mintmaker.appstudio.redhat.com/component": "gh-multi-component-child-vcod",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-mpxn",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "e3154057185f",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_build-nudge-child-umyeqa",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-4cd97d10",
                    "tekton.dev/pipelineRun": "renovate-05130400-4cd97d10",
                    "tekton.dev/pipelineRunUID": "ad84449d-3046-46bf-be45-bc4086962b3b",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-4cd97d10-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-4cd97d10",
                        "uid": "ad84449d-3046-46bf-be45-bc4086962b3b"
                    }
                ],
                "resourceVersion": "173159",
                "uid": "1a489847-e20e-4d31-8e1b-31ef1b837920"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-4cd97d10",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-4cd97d10-d3f5cc0a",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-4cd97d10",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-4cd97d10"
                        },
                        {
                            "name": "secret-renovate-05130400-4cd97d10-d3f5cc0a",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-4cd97d10"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:30Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-4cd97d10-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-4cd97d10-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-e8383a399f1cab93afed4b66e0d4a5ec-84278f740956ce10-01"
                },
                "startTime": "2026-05-13T04:00:15Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:30Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-4cd97d10-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:21Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:30Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-4cd97d10-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:24Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:30Z",
                            "message": "Step renovate terminated as pod renovate-05130400-4cd97d10-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:15Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-4cd97d10",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-4cd97d10-d3f5cc0a",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-4cd97d10",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-4cd97d10"
                        },
                        {
                            "name": "secret-renovate-05130400-4cd97d10-d3f5cc0a",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-4cd97d10"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/0444f9b8-df31-418b-95d3-a0eacdb0082e/records/124de048-4bda-4a8d-b3a0-62825ad987c9",
                    "results.tekton.dev/result": "mintmaker/results/0444f9b8-df31-418b-95d3-a0eacdb0082e",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-3c3bd777dac8d447ed2bfbda2c053791-66d18f9927488b2c-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:18Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "moshekipod-backwards-compat-dr",
                    "mintmaker.appstudio.redhat.com/branch": "main",
                    "mintmaker.appstudio.redhat.com/component": "mathwizz-frontend",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "dr-test-moshekipod-backwards-compat-dr",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "2c2d89b262da",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_DR-MathWizz-kohyxd",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-61d23047",
                    "tekton.dev/pipelineRun": "renovate-05130400-61d23047",
                    "tekton.dev/pipelineRunUID": "0444f9b8-df31-418b-95d3-a0eacdb0082e",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-61d23047-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-61d23047",
                        "uid": "0444f9b8-df31-418b-95d3-a0eacdb0082e"
                    }
                ],
                "resourceVersion": "173130",
                "uid": "124de048-4bda-4a8d-b3a0-62825ad987c9"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-61d23047",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-61d23047-928e0236",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-61d23047",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-61d23047"
                        },
                        {
                            "name": "secret-renovate-05130400-61d23047-928e0236",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-61d23047"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:29Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-61d23047-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-61d23047-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-3c3bd777dac8d447ed2bfbda2c053791-66d18f9927488b2c-01"
                },
                "startTime": "2026-05-13T04:00:18Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-61d23047-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:21Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-61d23047-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:24Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:29Z",
                            "message": "Step renovate terminated as pod renovate-05130400-61d23047-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:18Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-61d23047",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-61d23047-928e0236",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-61d23047",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-61d23047"
                        },
                        {
                            "name": "secret-renovate-05130400-61d23047-928e0236",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-61d23047"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/fda05ebd-4975-4e34-87bc-11177fc19a2d/records/07bae5f1-ae6c-4de2-9011-bbd1bab3d14e",
                    "results.tekton.dev/result": "mintmaker/results/fda05ebd-4975-4e34-87bc-11177fc19a2d",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-629307ac6f9429df6dbb8666aedbd6f5-a1d8248eb6013538-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:16Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "build-suite-component-update-btzn",
                    "mintmaker.appstudio.redhat.com/branch": "multi-component-child-base-payf",
                    "mintmaker.appstudio.redhat.com/component": "gl-multi-component-child-payf",
                    "mintmaker.appstudio.redhat.com/git-host": "gitlab.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "gitlab",
                    "mintmaker.appstudio.redhat.com/namespace": "build-e2e-vnes",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "1e5b31f1931f",
                    "mintmaker.appstudio.redhat.com/repository": "konflux-qe_build-nudge-child-atunsy",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-ab3e8a75",
                    "tekton.dev/pipelineRun": "renovate-05130400-ab3e8a75",
                    "tekton.dev/pipelineRunUID": "fda05ebd-4975-4e34-87bc-11177fc19a2d",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-ab3e8a75-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-ab3e8a75",
                        "uid": "fda05ebd-4975-4e34-87bc-11177fc19a2d"
                    }
                ],
                "resourceVersion": "172783",
                "uid": "07bae5f1-ae6c-4de2-9011-bbd1bab3d14e"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-ab3e8a75",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-ab3e8a75-7eff27f6",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-ab3e8a75",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-ab3e8a75"
                        },
                        {
                            "name": "secret-renovate-05130400-ab3e8a75-7eff27f6",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-ab3e8a75"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:26Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:26Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-ab3e8a75-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-ab3e8a75-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-629307ac6f9429df6dbb8666aedbd6f5-a1d8248eb6013538-01"
                },
                "startTime": "2026-05-13T04:00:16Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-ab3e8a75-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:23Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-ab3e8a75-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:28Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:26Z",
                            "message": "Step renovate terminated as pod renovate-05130400-ab3e8a75-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:16Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-ab3e8a75",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-ab3e8a75-7eff27f6",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-ab3e8a75",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-ab3e8a75"
                        },
                        {
                            "name": "secret-renovate-05130400-ab3e8a75-7eff27f6",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-ab3e8a75"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "chains.tekton.dev/signed": "true",
                    "kueue.konflux-ci.dev/requests-mintmaker": "1",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "mintmaker/results/a1d60f64-cd51-43f3-89e6-15d1b20dc103/records/adcbc599-6150-43c9-a9d2-c3f45acf613d",
                    "results.tekton.dev/result": "mintmaker/results/a1d60f64-cd51-43f3-89e6-15d1b20dc103",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-7b7c17a3d2fdc41ed92cb847939d7f5a-be6bae67c51b44af-01\"}"
                },
                "creationTimestamp": "2026-05-13T04:00:17Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "kueue.x-k8s.io/priority-class": "konflux-dependency-update",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "mintmaker.appstudio.redhat.com/application": "kokohazamar-backwards-compat-dr",
                    "mintmaker.appstudio.redhat.com/branch": "main",
                    "mintmaker.appstudio.redhat.com/component": "mathwizz-frontend",
                    "mintmaker.appstudio.redhat.com/git-host": "github.com",
                    "mintmaker.appstudio.redhat.com/git-platform": "github",
                    "mintmaker.appstudio.redhat.com/namespace": "dr-test-kokohazamar-backwards-compat-dr",
                    "mintmaker.appstudio.redhat.com/repo-branch-hash": "9f37744e2541",
                    "mintmaker.appstudio.redhat.com/repository": "redhat-appstudio-qe_DR-MathWizz-rfgjbj",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-05130400-d5a2fd1b",
                    "tekton.dev/pipelineRun": "renovate-05130400-d5a2fd1b",
                    "tekton.dev/pipelineRunUID": "a1d60f64-cd51-43f3-89e6-15d1b20dc103",
                    "tekton.dev/pipelineTask": "build"
                },
                "name": "renovate-05130400-d5a2fd1b-build",
                "namespace": "mintmaker",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-05130400-d5a2fd1b",
                        "uid": "a1d60f64-cd51-43f3-89e6-15d1b20dc103"
                    }
                ],
                "resourceVersion": "172528",
                "uid": "adcbc599-6150-43c9-a9d2-c3f45acf613d"
            },
            "spec": {
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "mintmaker-controller-manager",
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-d5a2fd1b",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-d5a2fd1b-baf5c065",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-d5a2fd1b",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-d5a2fd1b"
                        },
                        {
                            "name": "secret-renovate-05130400-d5a2fd1b-baf5c065",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-d5a2fd1b"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "emptyDir": {},
                        "name": "shared-data"
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T04:02:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T04:02:25Z",
                        "message": "the step \"renovate\" in TaskRun \"renovate-05130400-d5a2fd1b-build\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/mintmaker-renovate-image:latest\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-05130400-d5a2fd1b-build-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "spanContext": {
                    "traceparent": "00-7b7c17a3d2fdc41ed92cb847939d7f5a-be6bae67c51b44af-01"
                },
                "startTime": "2026-05-13T04:00:17Z",
                "steps": [
                    {
                        "container": "step-prepare-db",
                        "imageID": "quay.io/konflux-ci/mintmaker-osv-database@sha256:58224f8f1ff2c55a6eace0b5fee5176980777b1e1c6fbec29654a229c7757d2a",
                        "name": "prepare-db",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "Step prepare-db terminated as pod renovate-05130400-d5a2fd1b-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:22Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-prepare-rpm-cert",
                        "imageID": "registry.access.redhat.com/ubi9@sha256:8ca59004c1c505bdabadd5202bd3363986f5bf873fcfb36f60561d7362fe52a7",
                        "name": "prepare-rpm-cert",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "Step prepare-rpm-cert terminated as pod renovate-05130400-d5a2fd1b-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:26Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-renovate",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T04:02:25Z",
                            "message": "Step renovate terminated as pod renovate-05130400-d5a2fd1b-build-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T04:00:17Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mintmaker-osv-database:latest",
                            "name": "prepare-db",
                            "script": "echo 'Copying OSV database to the shared workspace'; cp -r /data/osv-db /workspace/shared-data",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "registry.access.redhat.com/ubi9",
                            "name": "prepare-rpm-cert",
                            "script": "[ ! -f \"/etc/renovate/secret/rpm-activationkey\" ] \u0026\u0026 echo 'RPM secret not found. Exiting.' \u0026\u0026 exit 0;echo 'Generating RPM certificate and copying it to shared workspace';KEY_NAME=$(cat /etc/renovate/secret/rpm-activationkey);ORG_ID=$(cat /etc/renovate/secret/rpm-org);subscription-manager register --activationkey=\"$KEY_NAME\" --org=\"$ORG_ID\";mkdir -p /workspace/shared-data/rpm-certs;cp /etc/pki/entitlement/*-key.pem /workspace/shared-data/rpm-certs/key.pem;cp $(find /etc/pki/entitlement -maxdepth 1 -type f -name '*.pem' ! -name '*-key.pem' -print -quit) /workspace/shared-data/rpm-certs/cert.pem",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                },
                                "requests": {
                                    "cpu": "300m",
                                    "memory": "3584Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/home/renovate"
                                },
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "LOG_FORMAT",
                                    "value": "json"
                                },
                                {
                                    "name": "OSV_OFFLINE_DISABLE_DOWNLOAD",
                                    "value": "true"
                                },
                                {
                                    "name": "OSV_OFFLINE_ROOT_DIR",
                                    "value": "/workspace/shared-data/osv-db"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_KEY",
                                    "value": "/workspace/shared-data/rpm-certs/key.pem"
                                },
                                {
                                    "name": "DNF_VAR_SSL_CLIENT_CERT",
                                    "value": "/workspace/shared-data/rpm-certs/cert.pem"
                                },
                                {
                                    "name": "RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS",
                                    "value": "7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:latest",
                            "name": "renovate",
                            "script": "RENOVATE_TOKEN=$(cat /etc/renovate/secret/renovate-token) RENOVATE_CONFIG_FILE=/etc/renovate/config/config.js LOG_FILE=/workspace/shared-data/renovate-logs.json renovate || true",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "runAsUser": 1001120000
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/renovate/config",
                                    "name": "configmap-renovate-05130400-d5a2fd1b",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/renovate/secret",
                                    "name": "secret-renovate-05130400-d5a2fd1b-baf5c065",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/etc/pki/ca-trust/extracted/pem",
                                    "name": "configmap-trusted-ca-6ct58987ht",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "config.js",
                                        "path": "config.js"
                                    }
                                ],
                                "name": "renovate-05130400-d5a2fd1b",
                                "optional": false
                            },
                            "name": "configmap-renovate-05130400-d5a2fd1b"
                        },
                        {
                            "name": "secret-renovate-05130400-d5a2fd1b-baf5c065",
                            "secret": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "renovate-token",
                                        "path": "renovate-token"
                                    }
                                ],
                                "optional": false,
                                "secretName": "renovate-05130400-d5a2fd1b"
                            }
                        },
                        {
                            "configMap": {
                                "defaultMode": 420,
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "tls-ca-bundle.pem"
                                    }
                                ],
                                "name": "trusted-ca-6ct58987ht",
                                "optional": false
                            },
                            "name": "configmap-trusted-ca-6ct58987ht"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "shared-data"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/db52e5f1-de2c-4d0c-a144-1adc71e400be",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-b3fbbe11cdc6c546-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "tes8dca6a92b55b731346a0418baa0d9eb4-deprecated-base-image-check",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "80160",
                "uid": "db52e5f1-de2c-4d0c-a144-1adc71e400be"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "completionTime": "2026-05-13T03:05:32Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:32Z",
                        "message": "the step \"check-images\" in TaskRun \"tes8dca6a92b55b731346a0418baa0d9eb4-deprecated-base-image-check\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "tes8dca6a92b55b731346a0418b0a17f063b88f61412a87ed89a17c903d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-b3fbbe11cdc6c546-01"
                },
                "startTime": "2026-05-13T03:02:43Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:05:32Z",
                            "message": "Step check-images terminated as pod tes8dca6a92b55b731346a0418b0a17f063b88f61412a87ed89a17c903d-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T03:02:43Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    # Get base images from SBOM\n    cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n    if [ $? -ne 0 ]; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n  mkdir -p ${IMAGE_REPO_PATH}\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n    --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n    --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n    failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/e5671bcb-716f-4875-a89a-2253e35925a1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-bd99769f0482294f-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T02:58:32Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-comp8dca6a92b55b731346a0418baa0d9eb4-prefetch-dependencies",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "62329",
                "uid": "e5671bcb-716f-4875-a89a-2253e35925a1"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.3@sha256:214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    },
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-uvgqou"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:58:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:58:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-comp8dca6a92b55b731346f6f4062f25695df662103667aa0a3ae3-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "214dcd12ea5b30c431dc0a1fae483422c6d397e453f9e832489e93a47853c58f"
                        },
                        "entryPoint": "prefetch-dependencies",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-bd99769f0482294f-01"
                },
                "startTime": "2026-05-13T02:58:32Z",
                "steps": [
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://28ebac499b6e3b7f5119db2df7e3dc655394a7263dd7c4c91a86f6cee2d98dde",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:58:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/workspace/source/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/workspace/source/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well",
                            "name": "source"
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/c8f08a97-8081-4151-9fb0-2c91e643a8a1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-e9e80625e5f514bf-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-compon8dca6a92b55b731346a0418baa0d9eb4-rpms-signature-scan",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "76241",
                "uid": "c8f08a97-8081-4151-9fb0-2c91e643a8a1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:03:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:03:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-compon8dca6a92b55b731382a2b4d4f328fd740b090ae1cdb2341f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\", \"digests\": [\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 132, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:03:54+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-e9e80625e5f514bf-01"
                },
                "startTime": "2026-05-13T03:02:44Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:4bb1feaad4cb4735f8a5387e32691dfc1fe6097d28d56c23895866f88b211e28",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://fcc8f0f755086201d16a3d0468bf19ae5aea9e02be9a3d150650ffa70faeb230",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:53Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cd3a49a2db67fef73b36603b8cb3de2ae19a0d964747103d0a9f4f3265457772",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:54Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\\\", \\\"digests\\\": [\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 132, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:03:54+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/c755415b-37dd-4474-9b64-668768164b76",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-815d8dea43c79053-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-compone8dca6a92b55b731346a0418baa0d9eb4-sast-unicode-check",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "78449",
                "uid": "c755415b-37dd-4474-9b64-668768164b76"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check:0.4@sha256:c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:04:51Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:04:51Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-compone8dca6a92b55b7315940bc3e4c412b83787a9e4b555e8f1f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "c162d9d0cd1e4c64dfc340577ba8e6bf55ebd1bb859fe3157217de9b4473c640"
                        },
                        "entryPoint": "sast-unicode-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:04:49+00:00\",\"note\":\"Task sast-unicode-check success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-815d8dea43c79053-01"
                },
                "startTime": "2026-05-13T03:02:44Z",
                "steps": [
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cf21c8f292fd7f7e859dee3477874744a4c56d8ffd58288eef4f1d94517b50b7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:49Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:04:49+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://cdb7a4dc0bec3a306860b694ea0c60a92ddfdc63088c8de55ccd842241f8adc0",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:04:49+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/workspace/workspace"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n    \u003eraw_sast_unicode_check_out.txt \\\n    2\u003eraw_sast_unicode_check_out.log \\\n    || FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n    echo \"Failed to run find-unicode-control command\" \u003e\u00262\n    cat raw_sast_unicode_check_out.log\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n    echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n    --mode=json\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"${SCAN_PROP}\"\n    --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003e processed_sast_unicode_check_out.json 2\u003e processed_sast_unicode_check_out.err; then\n    echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n    cat processed_sast_unicode_check_out.err\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # Build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    # Append --record-excluded option if RECORD_EXCLUDED is true\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003e sast_unicode_check_out.json 2\u003e sast_unicode_check_out.error\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n        mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n    else\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003e sast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n    note=\"Task sast-unicode-check success: No finding was detected\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s  sast_unicode_check_out.sarif ]]; then\n    note=\"Task sast-unicode-check success: Some findings were detected, but filtered by known false positive\"\n    ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n    echo \"sast-unicode-check test failed because of the following issues:\"\n    cat sast_unicode_check_out.json\n    TEST_OUTPUT=\n    parse_test_output \"sast-unicode-check\" sarif sast_unicode_check_out.sarif  || true\n    note=\"Task sast-unicode-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0;\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n\n    if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-unicode-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/746422b8-7fcf-4f3e-b9d2-f42362573f61",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-bacbdc6680661c84-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:12Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-componen8dca6a92b55b731346a0418baa0d9eb4-build-image-index",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "74359",
                "uid": "746422b8-7fcf-4f3e-b9d2-f42362573f61"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:02:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:02:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-componen8dca6a92b55b736ed51815f6dbf483069340fd3e448023-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb"
                        },
                        "entryPoint": "build-image-index",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-bacbdc6680661c84-01"
                },
                "startTime": "2026-05-13T03:02:12Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7e6858d6b17fd489042b8990cde9565084d42c7b8af253763e5d2ca9fbb1cb06",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c3fdfce38b0b5c7a8481d9211b70e24f43bc04b22024ba68964b4b404bf4793c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:39Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ca959352dcfd604fac5c3d2e197df6ae5d0390e0cfbc21a58b8bc62992f63aa3",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:42Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:40Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            }
                        ],
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "250m",
                                    "memory": "4Gi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"test-componen8dca6a92b55b731346a0418baa0d9eb4-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/f0eb7dbc-1ab0-46c7-ab18-bd927f30551c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-56825bb0a9a563c5-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks",
                    "tekton.dev/task": "ecosystem-cert-preflight-checks",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pu6899660e828ee9270be967d2e89cbc17",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "78341",
                "uid": "f0eb7dbc-1ab0-46c7-ab18-bd927f30551c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "ecosystem-cert-preflight-checks"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:04:48Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:04:48Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-o6eee6ddeaf3416fddb24edf708bd5c23-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850"
                        },
                        "entryPoint": "ecosystem-cert-preflight-checks",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks"
                    }
                },
                "results": [
                    {
                        "name": "ARTIFACT_TYPE",
                        "type": "string",
                        "value": "application"
                    },
                    {
                        "name": "ARTIFACT_TYPE_SET_BY",
                        "type": "string",
                        "value": "introspection"
                    },
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\", \"digests\": [\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\"]}}"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641486\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-56825bb0a9a563c5-01"
                },
                "startTime": "2026-05-13T03:02:44Z",
                "steps": [
                    {
                        "container": "step-introspect",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "introspect",
                        "provenance": {},
                        "results": [
                            {
                                "name": "artifact-type",
                                "type": "string",
                                "value": "application"
                            },
                            {
                                "name": "artifact-type-set-by",
                                "type": "string",
                                "value": "introspection"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://b7bf062022f1a53d36c566910d52f9d46f70b4808931db666884e6ed068328c7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:27Z",
                            "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-generate-container-auth",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "generate-container-auth",
                        "provenance": {},
                        "results": [
                            {
                                "name": "auth-json-path",
                                "type": "string",
                                "value": "/auth/auth.json"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://c1a24bcc3f2a5e4cfb1f349c247bf44c7999b2947b9b2142d8ad04086a838b71",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:27Z",
                            "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:27Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-set-skip-for-bundles",
                        "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:557d6789136c2fe8d64303d1524453f06040f548f4fcabe6404366751c575064",
                        "name": "set-skip-for-bundles",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e8b3144682558d5c399faa6e74301096acd4dbc3cf15e2f11b777fd9ef821be7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:28Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:27Z"
                        },
                        "terminationReason": "Skipped"
                    },
                    {
                        "container": "step-app-check",
                        "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                        "name": "app-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://7749a1a8747cb4644a1e6a7939cac1b76209564a1226036650bef15bff9198a1",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:45Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-app-set-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "app-set-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "images-processed",
                                "type": "string",
                                "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\", \"digests\": [\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\"]}}"
                            },
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641486\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://a9eb7404f3f4a46eb7e16b07f18601321777612da4ef40ce97de2a9041719f4f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:46Z",
                            "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\\\", \\\"digests\\\": [\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778641486\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:46Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-final-outcome",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "final-outcome",
                        "provenance": {},
                        "results": [
                            {
                                "name": "test-output",
                                "type": "string",
                                "value": "{\"result\":\"FAILURE\",\"timestamp\":\"1778641486\",\"note\":\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\",\"successes\":7,\"failures\":1,\"warnings\":0}"
                            }
                        ],
                        "terminated": {
                            "containerID": "cri-o://6e08e39cbab3554efd09cad9ba42da72988fa2cf9382665282a31dd1095fb33d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:47Z",
                            "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"FAILURE\\\",\\\"timestamp\\\":\\\"1778641486\\\",\\\"note\\\":\\\"Task preflight is a FAILURE: Refer to Tekton task logs for more information\\\",\\\"successes\\\":7,\\\"failures\\\":1,\\\"warnings\\\":0}\",\"type\":4}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:47Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.",
                    "params": [
                        {
                            "description": "Image url to scan.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "introspect",
                            "description": "The type of artifact. Select from application, operatorbundle, or introspect.",
                            "name": "artifact-type",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform the image is built on.",
                            "name": "platform",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Ecosystem checks pass or fail outcome.",
                            "name": "TEST_OUTPUT",
                            "type": "string",
                            "value": "$(steps.final-outcome.results.test-output)"
                        },
                        {
                            "description": "The artifact type, either introspected or set.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type)"
                        },
                        {
                            "description": "How the artifact type was set.",
                            "name": "ARTIFACT_TYPE_SET_BY",
                            "type": "string",
                            "value": "$(steps.introspect.results.artifact-type-set-by)"
                        },
                        {
                            "description": "Collected image digests",
                            "name": "IMAGES_PROCESSED",
                            "type": "string",
                            "value": "$(steps.app-set-outcome.results.images-processed)"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_ARTIFACT_TYPE",
                                    "value": "introspect"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "introspect",
                            "results": [
                                {
                                    "description": "The type of artifact this task is considering.",
                                    "name": "artifact-type"
                                },
                                {
                                    "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n",
                                    "name": "artifact-type-set-by"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n  echo \"Artifact type will be determined by introspection.\"\n  _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n  # short circuit if the artifact type was set via parameter.\n  echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n  printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n  exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n  _CURRENT_ARCH=$(uname -m)\n  _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n  # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n  # to map them.\n  case ${_CURRENT_ARCH} in\n    \"aarch64\")\n      _CURRENT_ARCH=\"arm64\"\n      ;;\n    \"x86_64\")\n      _CURRENT_ARCH=\"amd64\"\n      ;;\n    *)\n      ;;\n  esac\n\n  # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n  _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n  if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n    echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n  else\n    # If there is no image for the current OS and architecture, just use the first one in the list.\n    _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n    _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n    _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n    _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n    echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n  fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n  | jq '.Labels | keys | .[]' -r \\\n  | { grep operators.operatorframework.io.bundle || true ;} \\\n  | tee /tmp/ecosystem-image-labels\nthen\n  echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n  exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "generate-container-auth",
                            "results": [
                                {
                                    "description": "Path to auth.json",
                                    "name": "auth-json-path"
                                }
                            ],
                            "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/auth",
                                    "name": "auth"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1",
                            "name": "set-skip-for-bundles",
                            "results": [
                                {
                                    "description": "A skipped tekton result for bundles.",
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/bundle",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "operatorbundle"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PFLT_DOCKERCONFIG",
                                    "value": "$(steps.generate-container-auth.results.auth-json-path)"
                                },
                                {
                                    "name": "PFLT_KONFLUX",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "PARAM_PLATFORM"
                                }
                            ],
                            "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1",
                            "name": "app-check",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n  # Extract part after slash if present\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n\n  # Validate against supported arch list. If it's not a known arch, return an error result\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n  /usr/local/bin/preflight check container \"$image_url\"\nfi\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                },
                                {
                                    "mountPath": "/auth",
                                    "name": "auth",
                                    "readOnly": true
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "PARAM_IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "app-set-outcome",
                            "results": [
                                {
                                    "description": "The overall outcome of this task.",
                                    "name": "test-output"
                                },
                                {
                                    "description": "Processed image digests.",
                                    "name": "images-processed"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n    # Check if results directory exits\n    RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n    if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n        continue\n    fi\n    # Process results\n    if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n    PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n    PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{  result: $result,\n    timestamp: $date,\n    note: $note,\n    successes: $successes|tonumber,\n    failures: $failures|tonumber,\n    warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n  docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n  if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n    digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n  fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n  digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/artifacts",
                                    "name": "pfltoutputdir"
                                }
                            ],
                            "when": [
                                {
                                    "input": "$(steps.introspect.results.artifact-type)",
                                    "operator": "in",
                                    "values": [
                                        "application"
                                    ]
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "final-outcome",
                            "results": [
                                {
                                    "name": "test-output"
                                }
                            ],
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n  printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n  exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mount",
                                    "name": "pfltoutputdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "pfltoutputdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "auth"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/71585a74-1509-414b-9380-773ba791c3a3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-7b2ea8ec912c4501-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "apply-tags",
                    "tekton.dev/task": "apply-tags",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-apply-tags",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "75584",
                "uid": "71585a74-1509-414b-9380-773ba791c3a3"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "apply-tags"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:03:34Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:03:34Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-on-pull-request-pnkls-apply-tags-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66"
                        },
                        "entryPoint": "apply-tags",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-7b2ea8ec912c4501-01"
                },
                "startTime": "2026-05-13T03:02:45Z",
                "steps": [
                    {
                        "container": "step-apply-additional-tags",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "apply-additional-tags",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://c06443007cffe203abba90f4b50e84e0d62b0ed2848c542f2a187b2ff0977619",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:03:33Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:03:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Applies additional tags to the built image.",
                    "params": [
                        {
                            "description": "Image repository and tag reference of the the built image.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest of the built image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional tags that will be applied to the image in the registry.",
                            "name": "ADDITIONAL_TAGS",
                            "type": "array"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                                "--digest",
                                "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d",
                                "--tags",
                                "--tags-from-image-label",
                                "konflux.additional-tags"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "apply-tags"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "apply-additional-tags"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/2bf5ef84-64ff-483e-9404-ddf705bacb48",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-8d476ddc15912832-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T02:58:50Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-min",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-build-container",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "72997",
                "uid": "2bf5ef84-64ff-483e-9404-ddf705bacb48"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "6h"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-min:0.9"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "source",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:02:11Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:02:11Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-of23d565c525f4abae7821abd646d82fa-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "83455b969b5b0f5e8cd96708b393343123754ec01d3d3cdaf531208693978a50"
                        },
                        "entryPoint": "buildah-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:0d312b03fb4a02b5ce2c6792d59beb286646a6794cf1d97e817f5cce0f3b23be"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-8d476ddc15912832-01"
                },
                "startTime": "2026-05-13T02:58:50Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0a9be6243d1a0245ed3e2d3fb45dfd892398fcef598339192229806e8a34339f",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:00:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:59:28Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/buildah-task@sha256:3bd8b2c9f2b809bd86457cbe8411051b5a000f312b5e48cab63ab288bf6bf330",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://51fce1f9af6df2d0ddd1c463c859e9a7d7ad4d09301ed69439d4f51cb0afc801",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:01:47Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:00:59Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://32ee9e4f18cc9137d21f19d8e618d9b64ca855fc01fc1a589c6decd6070db0bf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:06Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6383f216128db04c94da5dcbcb142cb0280844d2a5f77bda49058893eb72dca8",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:06Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:01:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://e1dbb5a6204425980340dc776b36dcbdf9c9660f9f914b0eaee73dbce0e581cf",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:02:11Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c@sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:0d312b03fb4a02b5ce2c6792d59beb286646a6794cf1d97e817f5cce0f3b23be\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:02:05Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "2Gi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "512Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "6h"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "ENTITLEMENT_SECRET",
                                "value": "etc-pki-entitlement"
                            },
                            {
                                "name": "ACTIVATION_KEY",
                                "value": "activation-key"
                            },
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--build-args",
                                "--env",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n  if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n    echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n    export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n    if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n      echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n      export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n    fi\n  fi\n}\n\nfunction unset_proxy {\n  echo \"[$(date --utc -Ins)] Unsetting proxy\"\n  unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n  echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n  CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n  \"$source_dir_path\" | \"$source_dir_path/\"*)\n    # path is valid, do nothing\n    ;;\n  *)\n    echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n    echo \"Source path: $source_dir_path\" \u003e\u00262\n    echo \"Resolved path: $context_dir_path\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n  # Instrumented builds (SAST) use this custom dockerfile step as their base\n  dockerfile_path=\"$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n  icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n  while IFS= read -r line || [[ -n \"$line\" ]]; do\n    # Skip empty lines and comments\n    if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n      ANNOTATIONS+=(\"--annotation\" \"$line\")\n    fi\n  done \u003c \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n    case $1 in\n        --build-args)\n            shift\n            # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n            # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n            # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do build_args+=(\"$1\"); shift; done\n            ;;\n        --env)\n            shift\n            # Collect env entries of the form KEY=value\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do env_vars+=(\"$1\"); shift; done\n            ;;\n        --labels)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do LABELS+=(\"--label\" \"$1\"); shift; done\n            ;;\n        --annotations)\n            shift\n            while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ANNOTATIONS+=(\"--annotation\" \"$1\"); shift; done\n            ;;\n        *)\n            echo \"unexpected argument: $1\" \u003e\u00262\n            exit 2\n            ;;\n    esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n  BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n  ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e /shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n    jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--pull=never\")\n  UNSHARE_ARGS+=(\"--net\")\n  buildah_retries=3\n\n  set_proxy\n\n  for image in $BASE_IMAGES; do\n    if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"\n    then\n      echo \"Failed to pull base image ${image}\"\n      exit 1\n    fi\n  done\n\n  unset_proxy\n\n  echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n  BUILDAH_ARGS+=(\"--cap-add=all\")\n  BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ] ; then\n  BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n  BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n  if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n    BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n  fi\n  if [ -n \"$BUILD_TIMESTAMP\" ]; then\n    echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n    exit 1\n  fi\n  # but do set it so that we get all the labels/annotations associated with it\n  BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n  BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n  # Identify the current arch to filter the prefetched content\n  PREFETCH_ARCH=\"$(uname -m)\"\n  echo \"$PREFETCH_ARCH\" \u003e /shared/prefetch-arch\n\n  echo \"Prefetched content will be made available\"\n\n  cp -r \"/workspace/source/cachi2\" /tmp/\n  chmod -R go+rwX /tmp/cachi2\n\n  # In case RPMs were prefetched and this is a multi-arch build,\n  # clean up the packages that do not match the architecture being built\n  RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n  if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n    echo \"Removing prefetched RPMs from non-matching architectures\"\n    PREFETCH_ARCH=\"$(uname -m)\"\n    for path in \"$RPM_PREFETCH_DIR\"/*; do\n      if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n        echo \"Removing: $path\"\n        rm -rf \"$path\"\n      else\n        echo \"Keeping: $path\"\n      fi\n    done\n  fi\n\n  VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n  # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n  # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n  sed -E -i \\\n      -e 'H;1h;$!d;x' \\\n      -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n    @igM' \\\n      \"$dockerfile_copy\"\n\n  prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n  if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n    echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n    mkdir -p \"$YUM_REPOS_D_FETCHED\"\n    if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n      cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n    fi\n  fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n  cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n  mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n  VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n  \"--label\" \"architecture=$(uname -m)\"\n  \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n  DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n  ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n  BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n  BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n  FINAL_BASE_IMAGE=$(\n    # Get the base image of the final stage\n    # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n    # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n    # Run the find_root_stage() function on the final stage\n    # If the final stage is scratch or oci-archive, return empty\n    jq -r '.Stages as $all_stages |\n      def find_root_stage($stage):\n        if $stage.From.Stage then\n          find_root_stage($all_stages[$stage.From.Stage.Index])\n        else\n          $stage\n        end;\n\n        find_root_stage(.Stages[-1]) |\n        if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n          empty\n        else\n          .BaseName\n        end' /shared/parsed_dockerfile.json |\n      tr -d '\"' |\n      tr -d \"'\"\n  )\n  if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n    set_proxy\n    buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null` `\n    unset_proxy\n    buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n  fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n  if [[ \"$label\" != \"--label\" ]]; then\n    label_pairs+=(\"$label\")\n  fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n  label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n  [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n  | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n  echo \"\" \u003e\u003e\"$dockerfile_copy\"\n  # Always write labels.json to the new standard location\n  echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  # Conditionally write to the old location for backward compatibility\n  if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n    echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n  fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n  containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n  ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n  cp \"$containerignore\" \"$ignorefile_copy\"\n  {\n    echo \"\"\n    echo \"!/labels.json\"\n    echo \"!/content-sets.json\"\n  } \u003e\u003e \"$ignorefile_copy\"\n  BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n  cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n  mkdir -p /shared/rhsm/etc/pki/entitlement\n  mkdir -p /shared/rhsm/etc/pki/consumer\n\n  VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \\\n                  -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \\\n                  -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n  echo \"Adding activation key to the build\"\n\n  if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n    # user is not running registration in the Containerfile: pre-register.\n    echo \"Pre-registering with subscription manager.\"\n    export RETRY_MAX_TRIES=6\n    if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"\n    then\n      echo \"Subscription-manager register failed\"\n      exit 1\n    fi\n    unset RETRY_MAX_TRIES\n    trap 'subscription-manager unregister || true' EXIT\n\n    # copy generated certificates to /shared volume\n    cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n    cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n    # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n    VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n  fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e /dev/null; then\n  cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n  VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n  echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n  if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n    echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n    echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n    exit 1\n  fi\n  # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n  # (we set the workdir using 'unshare -w')\n  context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n  VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n  # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n  # Instrumented builds (SAST) use this step as their base and add some other tools.\n  while read -r volume_mount; do\n    VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n  done \u003c\u003c\u003c \"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n  cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n  while read -r filename; do\n    echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n    BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n  done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n    buildah build\n    \"${VOLUME_MOUNTS[@]}\"\n    \"${BUILDAH_ARGS[@]}\"\n    \"${LABELS[@]}\"\n    \"${ANNOTATIONS[@]}\"\n    --tls-verify=\"$TLSVERIFY\" --no-cache\n    --ulimit nofile=4096:4096\n    --http-proxy=false\n    -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n  # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n  command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n  command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n  # Get the image pullspec and filter out a tag if it is not set\n  # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n  base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n  # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n  # if buildah did not use that particular image during build because it was skipped\n  if [ -n \"$base_image_digest\" ]; then\n    echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n  fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "test-component-pac-pkyjur-on-pull-request-pnkls-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"\nthen\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n  [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n  [rekorInternalUrl]=REKOR_URL\n  [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n  [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n  [rekorInternalUrl]=rekorExternalUrl\n  [fulcioInternalUrl]=fulcioExternalUrl\n  [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e /shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\n  cyclonedx)\n    syft_sbom_type=cyclonedx-json@1.5 ;;\n  spdx)\n    syft_sbom_type=spdx-json@2.3 ;;\n  *)\n    echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n    exit 1\n    ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/source/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "10m",
                                    "memory": "128Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n    --additional-base-images)\n      shift\n      while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n      ;;\n    *)\n      echo \"unexpected argument: $1\" \u003e\u00262\n      exit 2\n      ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/workspace/source/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/workspace/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n  then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"\n  then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/source"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code to build.",
                            "name": "source"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/90b6a63e-0f7b-47c2-b96b-dc105af13f93",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-30c832170644b06a-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "clair-scan",
                    "tekton.dev/task": "clair-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-clair-scan",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "81743",
                "uid": "90b6a63e-0f7b-47c2-b96b-dc105af13f93"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clair-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:06:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:06:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-on-pull-request-pnkls-clair-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609"
                        },
                        "entryPoint": "clair-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\", \"digests\": [\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\":\"sha256:28bc096140e76a3e33009ad9386ba2301b6a6057b4f9af58ac6398fb37d5d61a\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":8,\"medium\":146,\"low\":151,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-13T03:06:22+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-30c832170644b06a-01"
                },
                "startTime": "2026-05-13T03:02:43Z",
                "steps": [
                    {
                        "container": "step-get-image-manifests",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "get-image-manifests",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://1cadd71ff7ed339d7fe1c3cf093ffc9a1b88b09f5941f4a081411740682b617d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://44c06a127076a505872288f6ebb25a1a3c061bf1fa22efc37d23d026e49e1a9d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:19Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/oras@sha256:a8d8dedde37815c2994c40eb5cb7381dbc6b26b833e0f736a3a752d993206c6b",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://8b2896434e904991220c708c0fa976485267071724c34c0e1fb35c5a776a259a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:21Z",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:52cc21d3a3cd44dac8c77638268ef1f83f908008e98529603048b8c42b544091",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://df72aa5a880c8efd7aa81accc693c60784b5e79e25a34c1e9d004d7187624f79",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:06:22Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\\\", \\\"digests\\\": [\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\":\\\"sha256:28bc096140e76a3e33009ad9386ba2301b6a6057b4f9af58ac6398fb37d5d61a\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":8,\\\"medium\\\":146,\\\"low\\\":151,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-13T03:06:22+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:06:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform built by.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused, should be removed in next task version.",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Clair scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "get-image-manifests",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "7Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clair-in-ci:v1",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n  { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee  \"clair-report-$2.json\"; } \u0026\u0026 \\\n  { retry clair-action convert  --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-$arch.sha\"\n\n  if [ -e \"$sha_file\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n    local digest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running clair-action on $arch image manifest...\"\n    clair_report \"$digest\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n   fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 0\n      ;;\n  esac\n\n  run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_clair_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n  echo 'No Clair reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n  fi\n\n  #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/abde5032-910e-4428-a208-4e1cdf05aadf",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-837aab6c88ee3bb1-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-clamav-scan",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "79372",
                "uid": "abde5032-910e-4428-a208-4e1cdf05aadf"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:05:10Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:10Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-on-pull-request-pnkls-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a"
                        },
                        "entryPoint": "clamav-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\", \"digests\": [\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1778641499\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-837aab6c88ee3bb1-01"
                },
                "startTime": "2026-05-13T03:02:45Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:4f7754695ae2d8b5977d488bbb8ff0710b1cc3811988be783076638724f2e4f4",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://4699d7a0fe2164be32966d0556df4f9b0c3b6768acee59d2daf5ae919b29960d",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\\\", \\\"digests\\\": [\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641499\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:983fd3222163307ea38019b54862873ad3443ecba85173aa866a8d2a105338de",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://0d01a097b5cd6ea6f742abc697ef9fb100c4e5f5e4cb9a497996c07cce7c95d7",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:05:09Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c\\\", \\\"digests\\\": [\\\"sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778641499\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:05:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                },
                                "requests": {
                                    "cpu": "7300m",
                                    "memory": "12Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=$(echo content-$arch)\n    mkdir -p \"$destination\"\n    arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n    if [ $? -ne 0 ]; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/7712c72b-b67b-4d36-bcf7-2c94a62b3702",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-37561e590c303d9c-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T02:58:09Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-init",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "60203",
                "uid": "7712c72b-b67b-4d36-bcf7-2c94a62b3702"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:58:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:58:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-on-pull-request-pnkls-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-37561e590c303d9c-01"
                },
                "startTime": "2026-05-13T02:58:09Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://dd34fa4b85c506e2afd04e89b74d270555e387c6f32f075251456b779e5f4d1e",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:58:14Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:14Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/7705f9cc-625b-4320-aeb0-3175a28a8be1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-f19d0dd421767dfb-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "push-dockerfile",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-push-dockerfile",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "78018",
                "uid": "7705f9cc-625b-4320-aeb0-3175a28a8be1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "push-dockerfile"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3@sha256:359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:04:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:04:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-obbd0eafd4a1112d77d7d77582765437b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "359199272c9a403275162a6741d098d7987334232630b59093d781c743fa99e7"
                        },
                        "entryPoint": "push-dockerfile",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:51d604bcddc1c8fcba7fba61cb720f526f860b643f3148efecbf85e932426851"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-f19d0dd421767dfb-01"
                },
                "startTime": "2026-05-13T03:02:44Z",
                "steps": [
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://98b5d59b2f594343b7e08db2e9ef918ab92f19006ad0edbe25700b8198fcac77",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:40Z",
                            "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur@sha256:51d604bcddc1c8fcba7fba61cb720f526f860b643f3148efecbf85e932426851\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.",
                    "params": [
                        {
                            "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": ".dockerfile",
                            "description": "Suffix of the Dockerfile image tag.",
                            "name": "TAG_SUFFIX",
                            "type": "string"
                        },
                        {
                            "default": "application/vnd.konflux.dockerfile",
                            "description": "Artifact type of the Dockerfile image.",
                            "name": "ARTIFACT_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level to use in the task. See golang logrus docs for available levels.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest-pinned image reference to the Dockerfile image.",
                            "name": "IMAGE_REF",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "--source",
                                "source",
                                "--context",
                                ".",
                                "--containerfile",
                                "Dockerfile",
                                "--image-url",
                                "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                                "--image-digest",
                                "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d",
                                "--artifact-type",
                                "application/vnd.konflux.dockerfile",
                                "--tag-suffix",
                                ".dockerfile",
                                "--result-path-image-ref",
                                "/tekton/results/IMAGE_REF",
                                "--alternative-filename",
                                "Dockerfile"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "image",
                                "push-containerfile"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "push",
                            "workingDir": "/workspace/workspace"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "Workspace containing the source code from where the Dockerfile is discovered.",
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/a535a25e-5241-408f-811d-2c51155af7de",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-4d00dae5a4250d02-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "sast-snyk-check",
                    "tekton.dev/task": "sast-snyk-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component-pac-pkyjur-on-pull-request-pnkls-sast-snyk-check",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "78365",
                "uid": "a535a25e-5241-408f-811d-2c51155af7de"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-snyk-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check:0.4@sha256:566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T03:04:49Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:04:49Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component-pac-pkyjur-o360228d9ced52f1ab72b4c720ff90fae-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "566753ca880764361b11f2c67d8e62dda94f829b11cb48e4716f27568216a481"
                        },
                        "entryPoint": "sast-snyk-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SKIPPED\",\"timestamp\":\"2026-05-13T03:04:48+00:00\",\"note\":\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-4d00dae5a4250d02-01"
                },
                "startTime": "2026-05-13T03:02:44Z",
                "steps": [
                    {
                        "container": "step-sast-snyk-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:aa2c97da9bb73a4e8d1c6b41950f8d902b74461be0e042debe89277fdc4ebe49",
                        "name": "sast-snyk-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ccaa01e2c8aec9020fa4e2a126f3e0734f198293d84467971a11c9f4abf6843a",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:48Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T03:04:48+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:6504e165b4e1411ca55069091a989fd27722a64ee0e3ec9fa7be5cf31d8b595f",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://6cd91e0bf1e503beeca2bd6a4d41978ab5e024f0d7d5f78fe4b041236325d90c",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T03:04:48Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SKIPPED\\\",\\\"timestamp\\\":\\\"2026-05-13T03:04:48+00:00\\\",\\\"note\\\":\\\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/)\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T03:04:48Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.\n\nFollow the steps given [here](https://konflux-ci.dev/docs/testing/build/snyk/) to obtain a snyk-token and to enable the snyk task in a Pipeline.\n\nThe snyk binary used in this Task comes from a container image defined in https://github.com/konflux-ci/konflux-test\n\nSee https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk tool.",
                    "params": [
                        {
                            "default": "snyk-secret",
                            "description": "Name of secret which contains Snyk token.",
                            "name": "SNYK_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Append arguments.",
                            "name": "ARGS",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Digest of the image to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Report only important findings in task result. Default is \"true\". To report all findings in task result, specify \"false\". Uploaded SARIF report to remote registry always includes all findings, regardless of severity level.",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Write excluded records in file. Useful for auditing (defaults to false).",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.",
                            "name": "IGNORE_FILE_PATHS",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "6Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "6Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SNYK_SECRET",
                                    "value": "snyk-secret"
                                },
                                {
                                    "name": "ARGS"
                                },
                                {
                                    "name": "IGNORE_FILE_PATHS"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac",
                            "name": "sast-snyk-check",
                            "script": "#!/usr/bin/env bash\n\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\n# Installation of Red Hat certificates for cloning Red Hat internal repositories\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSNYK_TOKEN_PATH=\"/etc/secrets/snyk_token\"\nif [ -f \"${SNYK_TOKEN_PATH}\" ] \u0026\u0026 [ -s \"${SNYK_TOKEN_PATH}\" ]; then\n  # SNYK token is provided\n  SNYK_TOKEN=\"$(cat ${SNYK_TOKEN_PATH})\"\n  export SNYK_TOKEN\nelse\n  # According to shellcheck documentation, the following error can be ignored as it is ignored through indirection: https://www.shellcheck.net/wiki/SC2034\n  # shellcheck disable=SC2034\n  to_enable_snyk='[here](https://konflux-ci.dev/docs/testing/build/snyk/)'\n  note=\"Task sast-snyk-check skipped: If you wish to use the Snyk code SAST task, please create a secret name snyk-secret with the key 'snyk_token' containing the Snyk token by following the steps given ${to_enable_snyk}\"\n  TEST_OUTPUT=$(make_result_json -r SKIPPED -t \"$note\")\n  echo \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# Wrapper around snyk code test that maps valid non-zero exit codes (1, 3)\n# to 0 so the existing retry function only retries on exit code 2 (error).\n# Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error, 3 = no supported files\n# The real exit code is always preserved in SNYK_EXIT_CODE.\n# Error codes (2+) always override, valid codes (0, 1, 3) only if no previous error.\n_snyk_code_test() {\n  snyk code test \"$@\" 1\u003e\u00262\u003e\u003e stdout.txt\n  local ec=$?\n  if [[ \"$ec\" -ne 0 ]] \u0026\u0026 [[ \"$ec\" -ne 1 ]] \u0026\u0026 [[ \"$ec\" -ne 3 ]]; then\n    SNYK_EXIT_CODE=$ec\n  fi\n  if [[ \"$ec\" -eq 1 ]] || [[ \"$ec\" -eq 3 ]]; then\n    return 0\n  fi\n  return \"$ec\"\n}\n\nSNYK_EXIT_CODE=0\nSOURCE_CODE_DIR=/workspace/workspace\n\n# We ignore files using snyk ignore if the user set up the IGNORE_FILE_PATHS variable.\n(cd \"${SOURCE_CODE_DIR}\" \u0026\u0026 IFS=\",\" \u0026\u0026 for path in $IGNORE_FILE_PATHS; do\n  snyk ignore --file-path=\"source/${path}\"\ndone)\n\nset +e\necho \"INFO: Running 'snyk code test'..\"\n# We do want to expand ARGS (it can be multiple CLI flags, not just one)\n# shellcheck disable=SC2086\n\n# Generate full paths for each directory in TARGET_DIRS\nIFS=\",\" read -ra TARGETS_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGETS_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # Ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ ! \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\n\n  # Ensure directory exists\n  if [ ! -d \"$resolved_path\" ]; then\n    echo \"Warning: Directory $resolved_path does not exist, skipping\"\n    continue\n  fi\n\n  echo \"INFO: Scanning directory: $resolved_path\"\n  # We do want to expand ARGS (it can be multiple CLI flags, not just one)\n  # shellcheck disable=SC2086\n  RETRY_INTERVAL=30 retry _snyk_code_test $ARGS \"$resolved_path\" --max-depth=1 --sarif-file-output=\"${resolved_path}/sast_snyk_check_out_${d//\\//_}.json\"\n\ndone\n\n# Merge all SARIF outputs\nfind \"$SOURCE_CODE_DIR\" -name \"sast_snyk_check_out_*.json\" -exec cat {} + \u003e \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\nset -e\ntest_not_skipped=0\nSKIP_MSG=\"We found 0 supported files\"\ngrep -q \"$SKIP_MSG\" stdout.txt || test_not_skipped=$?\n\nif [[ \"$SNYK_EXIT_CODE\" -eq 0 ]] || [[ \"$SNYK_EXIT_CODE\" -eq 1 ]]; then\n  # Check if the merged SARIF file has content - this could happen if the snyk scan found no findings\n  if [ ! -s \"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\" ]; then\n    echo \"WARN: No JSON output files were generated by snyk scan\"\n    # Get snyk version for proper SARIF metadata\n    SNYK_VERSION=$(snyk --version 2\u003e/dev/null | head -1 | tr -d '\\n' || echo \"unknown\")\n    # Create a valid minimal SARIF structure using jq\n    # Note: coverage array is required even when empty because downstream jq commands expect it\n    jq -n --arg version \"$SNYK_VERSION\" '{\n      \"$schema\": \"https://json.schemastore.org/sarif-2.1.0.json\",\n      \"version\": \"2.1.0\",\n      \"runs\": [{\n        \"tool\": {\n          \"driver\": {\n            \"name\": \"snyk\",\n            \"version\": $version,\n            \"informationUri\": \"https://snyk.io\"\n          }\n        },\n        \"results\": [],\n        \"properties\": {\n          \"coverage\": []\n        }\n      }]\n    }' \u003e\"${SOURCE_CODE_DIR}/sast_snyk_check_out.json\"\n  fi\n\n  # In order to generate csdiff/v1, we need to add the whole path of the source code as Snyk only provides an URI to embed the context\n  (cd  \"${SOURCE_CODE_DIR}\" \u0026\u0026 csgrep --mode=json --embed-context=3 \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json) \\\n    | csgrep --mode=json --strip-path-prefix=\"source/\"  \\\n    \u003e sast_snyk_check_out_all_findings.json\n\n  echo \"INFO: Initial results:\"\n  csgrep --mode=evtstat sast_snyk_check_out_all_findings.json\n\n  if [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\n  fi\n  PROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n  # create the KFP clone directory regardless\n  KFP_DIR=\"known-false-positives\"\n  KFP_CLONED=\"0\"\n  mkdir \"${KFP_DIR}\"\n\n  # We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\n  if [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n      echo \"INFO: Trying to clone known-false-positives..\"\n      git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\n  fi\n\n  if [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone know-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n    mv sast_snyk_check_out_all_findings.json filtered_sast_snyk_check_out.json\n  else\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    CMD=(\n      csfilter-kfp\n      --verbose\n      --kfp-dir=\"${KFP_DIR}\"\n      --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [ \"${RECORD_EXCLUDED}\" == \"true\" ]; then\n      CMD+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    set +e\n    \"${CMD[@]}\" sast_snyk_check_out_all_findings.json \u003e filtered_sast_snyk_check_out.json\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n      echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n      echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\n    echo \"INFO: Results after filtering:\"\n    (set -x \u0026\u0026 csgrep --mode=evtstat filtered_sast_snyk_check_out.json)\n  fi\n\n  # Generation of scan stats\n\n  total_files=$(jq '[.runs[0].properties.coverage[].files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n  supported_files=$(jq '[.runs[0].properties.coverage[] | select(.type == \"SUPPORTED\") | .files] | add' \"${SOURCE_CODE_DIR}\"/sast_snyk_check_out.json)\n\n  # We make sure the values are 0 if no supported/total files are found\n  if [ \"$total_files\" = \"null\" ] || [ -z \"$total_files\" ]; then\n    total_files=0\n  fi\n\n  if [ \"$supported_files\" = \"null\" ] || [ -z \"$supported_files\" ]; then\n    supported_files=0\n  fi\n\n  coverage_ratio=0\n  if (( total_files \u003e 0 )); then\n      coverage_ratio=$((supported_files * 100 / total_files))\n  fi\n\n  # embed stats in results file and convert to SARIF\n  csgrep --mode=sarif --set-scan-prop snyk-scanned-files-coverage:\"${coverage_ratio}\" \\\n                      --set-scan-prop snyk-scanned-files-success:\"${supported_files}\"  \\\n                      --set-scan-prop snyk-scanned-files-total:\"${total_files}\" \\\n                      filtered_sast_snyk_check_out.json  \u003e sast_snyk_check_out.sarif\n\n  # Create filtered SARIF for Tekton task result based on IMP_FINDINGS_ONLY parameter\n  if [ \"${IMP_FINDINGS_ONLY}\" == \"true\" ]; then\n    # Filter to only \"error\" level or higher (high/critical severity) for Tekton task result\n    # In SARIF, defects are given a level like \"error\" or \"warning\". Snyk maps \"high\" level findings to \"error\".\n    # - \"error\" → importance level 1\n    # - \"warning\" (or missing level) → importance level 0\n    RESULT_SARIF=\"result_sast_snyk_check_out.sarif\"\n    csgrep --mode=sarif --imp-level 1 sast_snyk_check_out.sarif \u003e \"$RESULT_SARIF\"\n  else\n    # Use all findings for Tekton task result\n    RESULT_SARIF=\"sast_snyk_check_out.sarif\"\n  fi\n\n  TEST_OUTPUT=\n  parse_test_output \"sast-snyk-check\" sarif \"$RESULT_SARIF\"  || true\n\n# When the test is skipped, the \"SNYK_EXIT_CODE\" is 3 and it can also be 3 in some other situation\nelif [[ \"$test_not_skipped\" -eq 0 ]]; then\n  note=\"Task sast-snyk-check success: Snyk code test found zero supported files.\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-snyk-check test failed because of the following issues:\"\n  cat stdout.txt\n  note=\"Task sast-snyk-check failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/secrets",
                                    "name": "snyk-secret",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_snyk_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n      echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n      continue\n    fi\n    if [ \"${UPLOAD_FILES}\" == \"excluded-findings.json\" ]; then\n        MEDIA_TYPE=application/json\n    else\n        MEDIA_TYPE=application/sarif+json\n    fi\n    echo \"Selecting auth\"\n    select-oci-auth \"${IMAGE_URL}\" \u003e \"${HOME}/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach to ${IMAGE_URL}\"\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-snyk-check"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "snyk-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "snyk-secret"
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/8fcfd05a-0e7c-42fe-83dd-fbaf5c717a57",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-e26740bf4b36a872-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T02:58:16Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component8dca6a92b55b731346a0418baa0d9eb4-clone-repository",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "61273",
                "uid": "8fcfd05a-0e7c-42fe-83dd-fbaf5c717a57"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "revision",
                        "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "output",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    },
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-uvgqou"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-05-13T02:58:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T02:58:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component8dca6a92b55b726df6688195d6128f900f9e378a01497-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7db7ad9653dccc771407cb0294487cf4be9064fa782ffad7e983db1a8ba57e21"
                        },
                        "entryPoint": "git-clone",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1778641070"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "5967acb"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                    }
                ],
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-e26740bf4b36a872-01"
                },
                "startTime": "2026-05-13T02:58:16Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://14aef526f87b9c6e332ca2f83d58f657e9d15910480ebf733263b36d3303fd19",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:58:29Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1},{\"key\":\"commit\",\"value\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641070\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"5967acb\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-symlink-check",
                        "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                        "name": "symlink-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "cri-o://ea8d45617ac624ce0d9e37bd9fb0c363c6ddfcc9688e81f0747dfe1744ead0f4",
                            "exitCode": 0,
                            "finishedAt": "2026-05-13T02:58:30Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1},{\"key\":\"commit\",\"value\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1778641070\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"5967acb\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-05-13T02:58:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.",
                    "params": [
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Length of short commit SHA",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "source",
                            "description": "Subdirectory inside the `output` Workspace to clone the repo into.",
                            "name": "subdirectory",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Clean out the contents of the destination directory if it already exists before cloning.",
                            "name": "deleteExisting",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Log the commands that are executed during `git-clone`'s operation.",
                            "name": "verbose",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Deprecated. Has no effect. Will be removed in the future.",
                            "name": "gitInitImage",
                            "type": "string"
                        },
                        {
                            "default": "/tekton/home",
                            "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n",
                            "name": "userHome",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_URL",
                                    "value": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report"
                                },
                                {
                                    "name": "PARAM_REVISION",
                                    "value": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "PARAM_REFSPEC"
                                },
                                {
                                    "name": "PARAM_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "PARAM_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "PARAM_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "PARAM_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "PARAM_DELETE_EXISTING",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "PARAM_VERBOSE",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "PARAM_USER_HOME",
                                    "value": "/tekton/home"
                                },
                                {
                                    "name": "PARAM_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_GIT_INIT_IMAGE"
                                },
                                {
                                    "name": "PARAM_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "PARAM_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "PARAM_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_BOUND",
                                    "value": "false"
                                },
                                {
                                    "name": "WORKSPACE_SSH_DIRECTORY_PATH"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND",
                                    "value": "true"
                                },
                                {
                                    "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH",
                                    "value": "/workspace/basic-auth"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "clone",
                            "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ] ; then\n  set -x\nfi\n\nif [ -n \"${PARAM_GIT_INIT_IMAGE}\" ]; then\n  echo \"WARNING: provided deprecated gitInitImage parameter has no effect.\"\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n    cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n  # Compatibility with kubernetes.io/basic-auth secrets\n  elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n    HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n    echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e \"${PARAM_USER_HOME}/.git-credentials\"\n    echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n  helper = store\" \u003e \"${PARAM_USER_HOME}/.gitconfig\"\n  else\n    echo \"Unknown basic-auth workspace format\"\n    exit 1\n  fi\n  chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n  chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ] ; then\n  cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n  chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n  chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\n\ncleandir() {\n  # Delete any existing contents of the repo directory if it exists.\n  #\n  # We don't just \"rm -rf ${CHECKOUT_DIR}\" because ${CHECKOUT_DIR} might be \"/\"\n  # or the root of a mounted volume.\n  if [ -d \"${CHECKOUT_DIR}\" ] ; then\n    # Delete non-hidden files and directories\n    rm -rf \"${CHECKOUT_DIR:?}\"/*\n    # Delete files and directories starting with . but excluding ..\n    rm -rf \"${CHECKOUT_DIR}\"/.[!.]*\n    # Delete files and directories starting with .. plus any other character\n    rm -rf \"${CHECKOUT_DIR}\"/..?*\n  fi\n}\n\nif [ \"${PARAM_DELETE_EXISTING}\" = \"true\" ] ; then\n  cleandir\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n  -url=\"${PARAM_URL}\" \\\n  -revision=\"${PARAM_REVISION}\" \\\n  -refspec=\"${PARAM_REFSPEC}\" \\\n  -path=\"${CHECKOUT_DIR}\" \\\n  -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n  -submodules=\"${PARAM_SUBMODULES}\" \\\n  -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n  -depth=\"${PARAM_DEPTH}\" \\\n  -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n  -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n  echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n  if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n    echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n  fi\n\n  # Determine if merging from a different repository or the same one\n  if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n    # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n    normalize_url() {\n      echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n    }\n\n    NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n    NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n    if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n      echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n      MERGE_REMOTE=\"origin\"\n    else\n      echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n      echo \"Adding remote 'merge-source'...\"\n      git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n      MERGE_REMOTE=\"merge-source\"\n    fi\n  else\n    echo \"Merging from the same repository (origin)\"\n    MERGE_REMOTE=\"origin\"\n  fi\n\n  echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n  if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n    retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  else\n    retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n  fi\n\n\n  echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n  git config --global user.email \"tekton-git-clone@tekton.dev\"\n  git config --global user.name \"Tekton Git Clone Task\"\n\nif ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n  echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n  echo \"--- Git Status ---\"\n  git status\n  echo \"------------------\"\n  exit 1\nfi\n\n# Check if there are changes staged for commit\nif git diff --staged --quiet; then\n  echo \"No diff was found, skipping merge...\" \u003e\u00262\nelse\n  echo \"Merge successful (no conflicts found), committing...\"\nif ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n  echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n  exit 1\nfi\n  MERGED_SHA=$(git rev-parse HEAD)\n  echo \"New HEAD after merge: ${MERGED_SHA}\"\n  echo \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n\nelse\n  echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e \"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ] ; then\n  echo \"Fetching tags\"\n  retry git fetch --tags\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "PARAM_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "PARAM_SUBDIRECTORY",
                                    "value": "source"
                                },
                                {
                                    "name": "WORKSPACE_OUTPUT_PATH",
                                    "value": "/workspace/output"
                                }
                            ],
                            "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434",
                            "name": "symlink-check",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nCHECKOUT_DIR=\"${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}\"\ncheck_symlinks() {\n  FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n  while read -r symlink\n  do\n    target=$(readlink -m \"$symlink\")\n    if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n      echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n      FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n    fi\n  done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n  if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ] ; then\n    return 1\n  fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ] ; then\n  echo \"Running symlink check\"\n  check_symlinks\nfi\n"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "The git repo will be cloned onto the volume backing this Workspace.",
                            "name": "output"
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        },
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report?rev=5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/commit_sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "build.appstudio.redhat.com/pull_request_number": "9716",
                    "build.appstudio.redhat.com/target_branch": "base-exdjny",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-b986b598e6",
                    "pipeline.tekton.dev/release": "aed2bc5aac6c6473758a06c203501bebc0780097",
                    "pipelinesascode.tekton.dev/branch": "base-exdjny",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uvgqou",
                    "pipelinesascode.tekton.dev/git-provider": "github",
                    "pipelinesascode.tekton.dev/installation-id": "40773614",
                    "pipelinesascode.tekton.dev/log-url": "https://console-openshift-console.apps.rosa.kx-41a411cbd4.kmlz.p3.openshiftapps.com/k8s/ns/stat-rep-ruwz/tekton.dev~v1~PipelineRun/test-component-pac-pkyjur-on-pull-request-pnkls",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"base-exdjny\"",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/repository": "github.com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "rhtap-qe-app[bot]",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/sha-title": "RHTAP-Qe-App update test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report/commit/5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-test-component-pac-pkyjur",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c/records/87e55174-9447-44d3-a3e4-45dc96b5eef7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"konflux-test-integration-status-report\",\"commit\":\"5967acb78c0815f7cc48cb9ae9cbfd66e952686c\",\"eventType\":\"pull_request\",\"pull_request-id\":9716}",
                    "results.tekton.dev/result": "stat-rep-ruwz/results/1d076a4b-c697-445e-8864-38ec62acc91c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8e39db34569f2bb357371dece7e22451-c00225b01d5d72d4-01\"}",
                    "test.appstudio.openshift.io/pr-group": "konflux-test-component-pac-pkyjur",
                    "test.appstudio.openshift.io/snapshot-creation-report": "SnapshotCreationFailed"
                },
                "creationTimestamp": "2026-05-13T03:02:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun",
                    "chains.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.46.0",
                    "appstudio.openshift.io/application": "integ-app-svih",
                    "appstudio.openshift.io/component": "test-component-pac-pkyjur",
                    "kueue.x-k8s.io/priority-class": "konflux-pre-merge-build",
                    "kueue.x-k8s.io/queue-name": "pipelines-queue",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/check-run-id": "75707042700",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "test-component-pac-pkyjur-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "9716",
                    "pipelinesascode.tekton.dev/repository": "com.redhat-appstudio-qe.konflux-test-integration-status-report",
                    "pipelinesascode.tekton.dev/sha": "5967acb78c0815f7cc48cb9ae9cbfd66e952686c",
                    "pipelinesascode.tekton.dev/state": "queued",
                    "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe",
                    "pipelinesascode.tekton.dev/url-repository": "konflux-test-integration-status-report",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRun": "test-component-pac-pkyjur-on-pull-request-pnkls",
                    "tekton.dev/pipelineRunUID": "1d076a4b-c697-445e-8864-38ec62acc91c",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check",
                    "test.appstudio.openshift.io/pr-group-sha": "9d547b4eb473f87c703fef5dc19d2efc07ffdbd7a59ad9872080c8655b5a29"
                },
                "name": "test-component8dca6a92b55b731346a0418baa0d9eb4-sast-shell-check",
                "namespace": "stat-rep-ruwz",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "test-component-pac-pkyjur-on-pull-request-pnkls",
                        "uid": "1d076a4b-c697-445e-8864-38ec62acc91c"
                    }
                ],
                "resourceVersion": "80482",
                "uid": "87e55174-9447-44d3-a3e4-45dc96b5eef7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    }
                ],
                "podTemplate": {
                    "nodeSelector": {
                        "konflux-ci.dev/workload": "konflux-tenants"
                    },
                    "tolerations": [
                        {
                            "effect": "NoSchedule",
                            "key": "konflux-ci.dev/workload",
                            "operator": "Equal",
                            "value": "konflux-tenants"
                        }
                    ]
                },
                "serviceAccountName": "build-pipeline-test-component-pac-pkyjur",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check:0.1@sha256:2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "2h0m0s",
                "workspaces": [
                    {
                        "name": "workspace",
                        "persistentVolumeClaim": {
                            "claimName": "pvc-3b0e4ff3f7"
                        }
                    }
                ]
            },
            "status": {
                "completionTime": "2026-05-13T03:05:40Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-05-13T03:05:40Z",
                        "message": "the step \"sast-shell-check\" in TaskRun \"test-component8dca6a92b55b731346a0418baa0d9eb4-sast-shell-check\" failed to pull the image \"\". The pod errored with the message: \"Back-off pulling image \"quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a\".\"",
                        "reason": "TaskRunImagePullFailed",
                        "status": "False",
                        "type": "Succeeded"
                    }
                ],
                "podName": "test-component8dca6a92b55b747a97077d08afb4628cc8ceba176e73c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "alpha",
                        "enableParamEnum": true,
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "2cd09c97b9f0fae9c7bcd26d956f77221fb7137ee8b2ef17e7351b5e6f1eb89e"
                        },
                        "entryPoint": "sast-shell-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check"
                    }
                },
                "spanContext": {
                    "traceparent": "00-8e39db34569f2bb357371dece7e22451-c00225b01d5d72d4-01"
                },
                "startTime": "2026-05-13T03:02:45Z",
                "steps": [
                    {
                        "container": "step-sast-shell-check",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:05:40Z",
                            "message": "Step sast-shell-check terminated as pod test-component8dca6a92b55b747a97077d08afb4628cc8ceba176e73c-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T03:02:44Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:5da32f9d64fdb2a960792e282f739e9d398a69e4c43d7183323ea8a13b845c73",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "exitCode": 1,
                            "finishedAt": "2026-05-13T03:05:40Z",
                            "message": "Step upload terminated as pod test-component8dca6a92b55b747a97077d08afb4628cc8ceba176e73c-pod is terminated",
                            "reason": "TaskRunImagePullFailed",
                            "startedAt": "2026-05-13T03:05:38Z"
                        },
                        "terminationReason": "TaskRunImagePullFailed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "8",
                                    "memory": "4Gi"
                                },
                                "requests": {
                                    "cpu": "1",
                                    "memory": "4Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.4.51@sha256:169f73f80fbde8d54f42416c5de8cc9214ecc7e8c89c70a3385285bbac32ad0a",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n    PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/workspace/workspace/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c \"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n    read -r quota period \u003c /sys/fs/cgroup/cpu.max\n    if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n        export SC_JOBS=$(((quota + period - 1) / period))\n        echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n    fi\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n    --mode=json\n    --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n    --remove-duplicates\n    --embed-context=3\n    --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n    # predefined list of shellcheck important findings\n    CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n    CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n    CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n    CSGREP_OPTS+=(\n        --event=\"$CSGREP_EVENT_FILTER\"\n    )\nelse\n    CSGREP_OPTS+=(\n        --event=\"error|warning\"\n    )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e \"$OUTPUT_FILE\"; then\n    echo \"Error occurred while running 'run-shellcheck.sh'\"\n    note=\"Task sast-shell-check failed: For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n    KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n    # Default location only reachable from internal Konflux instances, check reachable first\n    echo -n \"INFO: Probing ${PROBE_URL}... \"\n    if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n        echo \"INFO: Trying to clone known-false-positives..\"\n        git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n    fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n    echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n    echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n    # build initial csfilter-kfp command\n    csfilter_kfp_cmd=(\n        csfilter-kfp\n        --verbose\n        --kfp-dir=\"${KFP_DIR}\"\n        --project-nvr=\"${PROJECT_NAME}\"\n    )\n\n    if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n        csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n    fi\n\n    # Execute the command and capture any errors\n    set +e\n    \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e \"${OUTPUT_FILE}.filtered\" 2\u003e \"${OUTPUT_FILE}.error\"\n    status=$?\n    set -e\n    if [ \"$status\" -ne 0 ]; then\n        echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    else\n        mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n        echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n    fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003e shellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/stat-rep-ruwz/test-component-pac-pkyjur:on-pr-5967acb78c0815f7cc48cb9ae9cbfd66e952686c"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:f1b40899a2c35e6447a76939184190616e6c7f97b75b44ed4a380d52b3f78f6d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:6a46c5960cbcb81d9f6b0206163102d6f2e9e649ec231136f9ee33c02d3c1ad0",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n    echo 'No image-url or image-digest param provided. Skipping upload.'\n    exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n    if [ ! -f \"${UPLOAD_FILE}\" ]; then\n        echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n        continue\n    fi\n\n    # Determine the media type based on the file extension\n    if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n        MEDIA_TYPE=\"application/json\"\n    else\n        MEDIA_TYPE=\"application/sarif+json\"\n    fi\n\n    echo \"Selecting auth\"\n    select-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n    echo \"Attaching to ${IMAGE_URL}\"\n    if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\n    then\n      echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n      exit 1\n    fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/workspace/workspace/hacbs/sast-shell-check"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ],
                    "workspaces": [
                        {
                            "name": "workspace"
                        }
                    ]
                }
            }
        }
    ],
    "kind": "List",
    "metadata": {
        "resourceVersion": ""
    }
}